{ config, lib, pkgs, ... }:

{
  # Enable systemd-resolved with split DNS for ddev.site
  services.resolved = {
    enable = true;
    dnssec = "false";
    extraConfig = ''
      DNS=127.0.0.1:5353
      Domains=~ddev.site
    '';
  };

  # Integrate NetworkManager with systemd-resolved
  networking.networkmanager.dns = "systemd-resolved";

  # Local dnsmasq for .ddev.site resolution only (port 5353)
  services.dnsmasq = {
    enable = true;
    settings = {
      port = 5353;
      listen-address = "127.0.0.1";
      bind-interfaces = true;
      no-resolv = true;
      address = "/.ddev.site/127.0.0.1";
    };
  };

  # WireGuard VPN configuration
  networking.wireguard.interfaces = {
    wg0 = {
      ips = [ "10.42.98.201/32" ];
      # publicKey: YdlRGsjh4hS3OMJI+t6SZ2eGXKbs0wZBXWudHW4NyS8=
      privateKeyFile = config.sops.secrets.wg-cloonar-key.path;

      peers = [
        {
          publicKey = "TKQVDmBnf9av46kQxLQSBDhAeaK8r1zh8zpU64zuc1Q=";
          allowedIPs = [
            "10.42.96.0/20"
            # wohnservice-wien
            "10.254.240.0/24"
            "10.254.235.0/24"
            # epicenter.works
            "10.14.0.0/16"
            "10.25.0.0/16"
            "188.34.191.144/32" # web-arm
            "91.107.201.241" # mail
          ];
          endpoint = "vpn.cloonar.com:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
          persistentKeepalive = 25;
        }
      ];

      # Use resolvectl for systemd-resolved integration
      # Note: No postDown needed - systemd-resolved automatically handles interface removal
      postSetup = ''
        ${pkgs.systemd}/bin/resolvectl dns wg0 10.42.97.1
        ${pkgs.systemd}/bin/resolvectl domain wg0 cloonar.com
      '';
    };
  };
}