{
  config,
  lib,
  pkgs,
  this,
  ...
}:
let
  cfg = config.nixfiles.modules.common.networking;
in
{
  options.nixfiles.modules.common.networking.onlyDefault = lib.mkEnableOption "custom networking settings";

  config = lib.mkIf (!cfg.onlyDefault) {
    ark.directories =
      with config.networking;
      lib.optional networkmanager.enable "/etc/NetworkManager/system-connections"
      ++ lib.optional wireless.iwd.enable "/var/lib/iwd";

    networking = lib.mkMerge [
      {
        domain = lib.my.domain.shire;

        hostName = this.hostname;
        hostId = lib.substring 0 8 (builtins.hashString "md5" this.hostname);

        # Remove default hostname mappings. This is required at least by the
        # current implementation of the monitoring module.
        hosts = {
          "127.0.0.2" = lib.mkForce [ ];
          "::1" = lib.mkForce [ ];
        };

        # There's no way[1] to configure DNS server priority in
        # systemd-resolved. The only solution for dealing with a broken VPN
        # connection is to delete /etc/systemd/resolved.conf and restart the
        # systemd-resolved service. Otherwise I'll just end up with a random
        # server from the list most of the time because systemd-resolved
        # "conveniently" will manage server priority for me...
        #
        # [1]: https://askubuntu.com/questions/1116732/how-do-i-list-dns-server-order-in-systemd-resolve
        # [2]: https://github.com/systemd/systemd/issues/6076
        nameservers = with lib.my.configurations.manwe.wireguard; [
          ipv6.address
          ipv4.address
        ];

        useDHCP = false;

        nftables.enable = true;

        firewall = {
          enable = true;

          rejectPackets = false;

          allowPing = true;
          pingLimit = "1/minute burst 5 packets";

          logRefusedConnections = false;
          logRefusedPackets = false;
          logRefusedUnicastsOnly = false;
          logReversePathDrops = false;
        };
      }
      (
        let
          interface = "eth0"; # This assumes `usePredictableInterfaceNames` is false.
        in
        lib.mkIf (lib.hasAttr "ipv4" this && lib.hasAttr "ipv6" this) {
          usePredictableInterfaceNames = false; # NOTE This can break something!
          interfaces.${interface} = {
            ipv4.addresses =
              with this.ipv4;
              lib.optional (lib.isString address && lib.isInt prefixLength) {
                inherit address prefixLength;
              };

            ipv6.addresses =
              with this.ipv6;
              lib.optional (lib.isString address && lib.isInt prefixLength) {
                inherit address prefixLength;
              };
          };
          defaultGateway =
            with this.ipv4;
            lib.mkIf (lib.isString gatewayAddress) {
              inherit interface;
              address = gatewayAddress;
            };
          defaultGateway6 =
            with this.ipv6;
            lib.mkIf (lib.isString gatewayAddress) {
              inherit interface;
              address = gatewayAddress;
            };
        }
      )
      (lib.mkIf this.isHeadful {
        interfaces.eth0.useDHCP = lib.mkDefault true;

        networkmanager = {
          enable = lib.mkDefault true;
          unmanaged = [
            "bridge"
            "ethernet"
            "loopback"
            "wireguard"
          ];
          plugins = lib.mkForce [ ];
          wifi.backend = "iwd";
        };

        wireless = {
          enable = false;
          iwd.enable = lib.mkDefault true;
          userControlled.enable = true;
          allowAuxiliaryImperativeNetworks = true;
        };
      })
    ];

    services.resolved = {
      llmnr = "false";
      dnsovertls = "opportunistic";
      dnssec = "allow-downgrade";
      fallbackDns = lib.dns.mkDoT lib.dns.const.quad9.ecs;
    };

    environment = {
      shellAliases = lib.listToAttrs (
        map ({ name, value }: lib.nameValuePair name "${pkgs.iproute2}/bin/${value}") [
          {
            name = "bridge";
            value = "bridge -color=always";
          }
          {
            name = "ip";
            value = "ip -color=always";
          }
          {
            name = "tc";
            value = "tc -color=always";
          }
        ]
      );

      systemPackages = with pkgs; [
        ethtool
        myip
        nethogs
      ];
    };
  };
}