{
  config,
  inputs,
  lib,
  pkgs,
  this,
  ...
}:
with lib; let
  cfg = config.nixfiles.modules.wireguard;
in {
  options.nixfiles.modules.wireguard = {
    client = {
      enable = mkEnableOption "WireGuard client";

      enableTrafficRouting = mkOption {
        description = "Whether to enable traffic routing through the sever.";
        type = with types; bool;
        default = !this.isHeadless;
      };
    };

    server = {
      enable = mkEnableOption "WireGuard server";

      ipv4.address = mkOption {
        description = "IPv4 address to bind to.";
        type = with types; str;
        default = my.configurations.manwe.wireguard.ipv4.address;
      };

      ipv6.address = mkOption {
        description = "IPv4 address to bind to.";
        type = with types; str;
        default = my.configurations.manwe.wireguard.ipv6.address;
      };

      address = mkOption {
        description = "Endpoint address to use";
        type = with types; str;
        default = my.configurations.manwe.ipv4.address;
      };

      port = mkOption {
        description = "Endpoint port to use.";
        type = with types; int;
        default = 6969;
      };

      publicKey = mkOption {
        description = "Server's public key.";
        type = with types; str;
        default = my.configurations.manwe.wireguard.publicKey;
      };

      peers = mkOption {
        description = "List of peers.";
        type = with types; listOf attrs;
        default = mapAttrsToList (_: attr:
          with attr; {
            inherit (wireguard) publicKey;
            allowedIPs = with wireguard; [
              "${ipv4.address}/32"
              "${ipv6.address}/128"
            ];
          }) (filterAttrs (_: attr:
          attr.hostname != this.hostname && hasAttr "wireguard" attr)
        my.configurations);
      };
    };

    interface = mkOption {
      description = "Name of the interface to use WireGuard with.";
      type = with types; str;
      default = "wg69";
    };

    ipv4.subnet = mkOption {
      description = "CIDR notation for the IPv4 subnet to use over WireGuard.";
      type = with types; str;
      default = "10.69.0.0/16";
    };

    ipv6.subnet = mkOption {
      description = "CIDR notation for the IPv6 subnet to use over WireGuard.";
      type = with types; str;
      default = "fd69::/16";
    };
  };

  config =
    {
      assertions = [
        {
          assertion = config.security.sudo.enable;
          message = "Sudo is not enabled.";
        }
        {
          assertion = any (x: x == "wheel") config.my.extraGroups;
          message = ''User is not in the "wheel" group.'';
        }
      ];
    }
    // mkMerge [
      (mkIf (cfg.client.enable || cfg.server.enable) {
        secrets."wireguard-private-key-${this.hostname}".file = "${inputs.self}/secrets/wireguard-private-key-${this.hostname}";

        networking.firewall.trustedInterfaces = [cfg.interface];
      })
      (mkIf cfg.client.enable {
        networking.wg-quick.interfaces.${cfg.interface} = mkMerge [
          (with this.wireguard; {
            privateKeyFile = config.secrets."wireguard-private-key-${this.hostname}".path;
            address = ["${ipv4.address}/16" "${ipv6.address}/16"];
          })
          (with cfg.server; {
            peers = [
              {
                inherit publicKey;
                endpoint = "${address}:${toString port}";
                allowedIPs =
                  if cfg.client.enableTrafficRouting
                  then [
                    "0.0.0.0/0"
                    "::/0"
                  ]
                  else [
                    cfg.ipv4.subnet
                    cfg.ipv6.subnet
                  ];
                persistentKeepalive = 25;
              }
            ];
            dns = [
              ipv4.address
              ipv6.address
            ]; # This assumes that the host has Unbound running.
          })
        ];

        environment.systemPackages = with pkgs; [
          (writeShellApplication {
            name = "wg-toggle";
            runtimeInputs = [iproute2 jq wireguard-tools];
            text = ''
              ip46() {
                sudo ip -4 "$@"
                sudo ip -6 "$@"
              }

              fwmark=$(sudo wg show ${cfg.interface} fwmark) || exit
              if ip -j rule list lookup "$fwmark" | jq -e 'length > 0' >/dev/null; then
                  ip46 rule del lookup main suppress_prefixlength 0
                  ip46 rule del lookup "$fwmark"
              else
                  ip46 rule add not fwmark "$fwmark" lookup "$fwmark"
                  ip46 rule add lookup main suppress_prefixlength 0
              fi
            '';
          })
        ];
      })
      (mkIf cfg.server.enable {
        networking = {
          wireguard = {
            enable = true;
            interfaces.${cfg.interface} = with cfg.server; {
              privateKeyFile = config.secrets."wireguard-private-key-${this.hostname}".path;
              ips = ["${ipv4.address}/16" "${ipv6.address}/16"];
              listenPort = port;
              inherit peers;
              allowedIPsAsRoutes = false;
            };
          };

          nat = {
            enable = true;
            enableIPv6 = true;

            externalInterface = mkDefault "eth0";

            internalInterfaces = [cfg.interface];
            internalIPs = [cfg.ipv4.subnet];
            internalIPv6s = [cfg.ipv6.subnet];
          };

          firewall.allowedUDPPorts = [cfg.server.port];
        };

        services.prometheus.exporters.wireguard = {
          enable = true;
          listenAddress = mkDefault this.wireguard.ipv4.address;
          withRemoteIp = true;
          port = 9586;
        };
      })
    ];
}