{ config, ... }:

let hn = "nebula"; in {
  networking = {
    domain = config.constants.domain;
    firewall.allowedTCPPorts = [ 80 443 ];
    hostId = "e6449321";
    hostName = hn;
    networkmanager = {
      enable = true;
      wifi.backend = "iwd";
    };
    nftables.enable = true;
    tempAddresses = "disabled";
    wireless.iwd.enable = true;
  };

  sops.secrets."cloudflare/${hn}" = { };

  services.cloudflare-dyndns = {
    enable = true;
    apiTokenFile = config.sops.secrets."cloudflare/${hn}".path;
    domains = builtins.attrNames config.services.caddy.virtualHosts;
    ipv4 = false;
    ipv6 = true;
  };

  services.openssh = {
    enable = true;
    hostKeys = [{
      comment = "host@${hn}";
      path = "/etc/ssh/host";
      rounds = 100;
      type = "ed25519";
    }];
    settings = {
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;
    };
  };

  services.resolved.enable = true;
}