{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.os.core.network;
in
{
  options.os.core.network = {
    enable = lib.mkEnableOption "system-wide networking setup";
    enableFirewall = lib.mkEnableOption "integrated zero-trust nftables firewall layers";

    isVM = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = "Set to true if this configuration is running inside a guest VM. Set to false for the bare-metal host.";
    };

    ips = lib.mkOption {
      type = lib.types.attrsOf lib.types.str;
      default = {
        bare-metal = "10.0.0.2";
        opnsense-vm = "10.0.0.1";
        gateway-vm = "10.0.0.3";
        auth-vm = "10.0.0.4";
        database-vm = "10.0.0.5";
        monitor-vm = "10.0.0.6";
        media-vm = "10.0.0.7";
        torrent-vm = "10.0.0.8";
        storage-vm = "10.0.0.9";
        web-vm = "10.0.0.10";
        comm-vm = "10.0.0.11";
        mail-vm = "10.0.0.12";
        relay-vm = "10.0.0.13";
        gameserver-vm = "10.0.0.14";
      };
      description = "Central registry of static IP allocations for the cluster.";
    };

    profile = lib.mkOption {
      type = lib.types.enum [
        "client"
        "server"
      ];
      default = "client";
      description = "Which networking profile configuration to apply";
    };

    lan = lib.mkOption {
      description = "Physical Home Local Area Network configuration parameters.";
      type = lib.types.submodule {
        options = {
          ip = lib.mkOption {
            type = lib.types.str;
            default = "10.0.0.2";
            description = "The local static or leased IP assigned to this machine on the home network.";
          };
          range = lib.mkOption {
            type = lib.types.str;
            default = "10.0.0.0/24";
            description = "The broader subnet block representing the physical home network.";
          };
        };
      };
    };

    wg = lib.mkOption {
      description = "Standard WireGuard VPN tunnel configuration parameters.";
      type = lib.types.submodule {
        options = {
          ip = lib.mkOption {
            type = lib.types.str;
            default = "10.3.0.1";
            description = "The explicit tunnel IP address assigned to this machine's WireGuard interface.";
          };
          range = lib.mkOption {
            type = lib.types.str;
            default = "10.3.0.0/24";
            description = "The total addressable IP space assigned to the WireGuard network pool.";
          };
        };
      };
    };

    hs = lib.mkOption {
      description = "Headscale mesh overlay network configuration parameters.";
      type = lib.types.submodule {
        options = {
          ip = lib.mkOption {
            type = lib.types.str;
            default = "10.4.0.1";
            description = "The explicit mesh network IP address assigned to this machine via Headscale.";
          };
          range = lib.mkOption {
            type = lib.types.str;
            default = "10.4.0.0/24";
            description = "The full mesh overlay allocation subnet block.";
          };
        };
      };
    };
  };

  config = lib.mkIf cfg.enable (
    lib.mkMerge [
      {
        services.resolved.enable = true;
      }

      (lib.mkIf (cfg.profile == "client") {
        networking.networkmanager = {
          enable = true;
          dns = "systemd-resolved";
          wifi.macAddress = "random";
          wifi.backend = "iwd";
          ethernet.macAddress = "random";
        };

        systemd.services."NetworkManager-wait-online".enable = false;

        environment.systemPackages = [
          pkgs.impala
        ];
      })

      (lib.mkIf (cfg.profile == "client" && cfg.enableFirewall) {
        networking = {
          firewall.enable = true;
          nftables.enable = true;
        };
      })

      (lib.mkIf (cfg.profile == "server") {
        networking = {
          useNetworkd = true;
          useDHCP = false;
        };
        systemd.network = {
          enable = true;
          wait-online.enable = lib.mkIf (!cfg.isVM) false;

          netdevs = lib.mkIf (!cfg.isVM) {
            "10-br-srv" = {
              netdevConfig = {
                Name = "br-srv";
                Kind = "bridge";
              };
            };
          };
          networks."20-host-management" = {
            matchConfig.Name = if cfg.isVM then "eth0" else "br-srv";
            address = [ "${cfg.lan.ip}/24" ];
            gateway = [ cfg.ips.router ];
            networkConfig.LinkLocalAddressing = "no";
          };
        };
        boot.kernel.sysctl = {
          "net.ipv4.ip_nonlocal_bind" = 1;
          "net.ipv4.ip_forward" = 1;
        };
      })
      (lib.mkIf
        (
          cfg.profile == "server"
          && cfg.enableFirewall
          && cfg.isVM
          && config.networking.hostName != "vm2-gateway"
        )
        {
          networking.nftables.enable = true;
          networking.firewall = {
            enable = true;
            extraCommands = ''
              nft add table ip nat 2>/dev/null || true
              nft flush table ip nat
              nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; }
              nft add rule ip nat PREROUTING ip saddr ${cfg.ips.vm2-gateway} ip daddr ${cfg.lan.ip} redirect
            '';
          };
        }
      )
    ]
  );
}