{
  roles.default.perInstance = { settings, ... }: {
    nixosModule =
      {
        config,
        lib,
        ...
      }:
      let
        vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") settings.vlans;

        dir = config.clan.core.settings.directory;
        instance = "zerotier";

        networkId = builtins.readFile "${dir}/vars/shared/zerotier-network-${instance}/network-id/value";
        full = "fd" + networkId + "9993";
        hextet = i: builtins.substring (i * 4) 4 full;
        subnetZtier = "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
      in
      {
        services.iperf3.enable = true;

        networking.firewall.interfaces = lib.genAttrs vlanIfs (_: {
          allowedTCPPorts = [ 5201 ];
          allowedUDPPorts = [ 5201 ];
        });

        networking.firewall.extraInputRules = ''
          ip6 saddr ${subnetZtier} tcp dport 5201 accept comment "iperf3 over the mesh"
          ip6 saddr ${subnetZtier} udp dport 5201 accept comment "iperf3 over the mesh"
        '';
      };
  };
}