{ config, lib, ... }:
let
  baseTCP = [
    20
    22
    25
    80
    443
    config.services.grafana.settings.server.http_port
    config.services.prometheus.port
    config.services.mysql.settings.mysqld.port
  ]
  ++ lib.mapAttrsToList (_: opt: opt.port) (
    lib.filterAttrs (
      _: e:
      let
        evaluated = builtins.tryEval e;
      in
      evaluated.success && e ? enable && e.enable
    ) config.services.prometheus.exporters
  );

  baseUDP = [
  ];
  baseTCPRanges = [ ];
  baseUDPRanges = [ ];
in
{
  systemd.network = {
    enable = true;
    networks."10-uplink" = {
      matchConfig.Type = "ether";
      networkConfig = {
        DHCP = "ipv4";
        IPv6AcceptRA = "yes";
      };
      linkConfig = {
        RequiredForOnline = "yes";
      };
      ipv6AcceptRAConfig = {
        UseDNS = "yes";
        UseDomains = "yes";
      };
      dns = [
        "192.168.88.1"
        "1.1.1.1"
        "2606:4700:4700:0000:0000:0000:0000:1002"
      ];
    };
  };

  wilkuu.firewall = {
    enable = true;
    defaultLayer = "internal";
    layers.internal = {
      allowedTCPPorts = baseTCP;
      allowedUDPPorts = baseUDP;
      allowedUDPPortRanges = baseUDPRanges;
      allowedTCPPortRanges = baseTCPRanges;
    };
  };
  networking = {
    useNetworkd = true;
    nftables.enable = true;
    useDHCP = true;
  };

}