{
  roles.default.perInstance = { settings, ... }: {
    nixosModule =
      {
        config,
        lib,
        ...
      }:
      let
        dir = config.clan.core.settings.directory;
        instance = "zerotier";

        networkId = builtins.readFile "${dir}/vars/shared/zerotier-network-${instance}/network-id/value";
        full = "fd" + networkId + "9993";
        hextet = i: builtins.substring (i * 4) 4 full;
        subnetZtier = "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
      in
      {
        config = lib.mkIf (settings.enableOmada) {
          virtualisation.podman.enable = true;
          virtualisation.oci-containers = {
            backend = "podman";
            containers.omada = {
              image = "docker.io/mbentley/omada-controller:5.15";
              extraOptions = [ "--network=host" ];
              environment.TZ = config.time.timeZone;
              volumes = [
                "/var/lib/omada/data:/opt/tplink/EAPController/data"
                "/var/lib/omada/logs:/opt/tplink/EAPController/logs"
              ];
            };
          };

          networking.firewall.extraInputRules = ''
            ip6 saddr ${subnetZtier} tcp dport 8043 accept comment "omada ui over the mesh"
          '';

          clan.core.state.omada.folders = [ "/var/lib/omada" ];

        };
      };
  };
}