{ lib, config, ... }:
{
  options.system.wireguard = {
    client = {
      enable = lib.mkOption {    
        type = lib.types.bool;     
        default = true;       
        description = "Enable WireGuard client";
      };
    };
    server = {
      enable = lib.mkOption {    
        type = lib.types.bool;     
        default = false;       
        description = "Enable WireGuard server";
      };
    };
  };

  config = {
    networking = {
      firewall.allowedUDPPorts = [ 51820 ];

      nat = {
        enable = config.system.wireguard.server.enable;
        externalInterface = "${config.ips.netInt}";
        internalInterfaces = [ "${config.ips.wgInt}" ];
      };

      wireguard.interfaces = {
        "wgc" = lib.mkIf config.system.wireguard.client.enable {
          # Define IP of client in per device config
          listenPort = 51820;
          privateKey = config.secrets.wgClientPriv;
          peers = [
            { # NixOS Server
              publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
              allowedIPs = [ "${config.ips.wgSpan}.0/24" ];
              endpoint = "sv.${config.domains.jim1}:51820";
              persistentKeepalive = 25;
            }
          ];
        };

        "wgs" = lib.mkIf config.system.wireguard.server.enable {
          ips = [ "${config.ips.wgSpan}.1/24" ];
          listenPort = 51820;
          privateKey = config.secrets.wgServerPriv;
          peers = [
            { # NixOS
              publicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0=";
              allowedIPs = [ "${config.ips.wgSpan}.16/28" ];
            }
            { # Pixel 9
              publicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4=";
              allowedIPs = [ "${config.ips.wgSpan}.2/32" ];
            }
          ];
        };
      };
    };
  };
}