{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.os.core.network;
in
{
  options.os.core.network = {
    enable = lib.mkEnableOption "system-wide networking setup";

    profile = lib.mkOption {
      type = lib.types.enum [
        "client"
        "server"
      ];
      default = "client";
      description = "Which networking profile configuration to apply";
    };

    lan = lib.mkOption {
      description = "Physical Home Local Area Network configuration parameters.";
      type = lib.types.submodule {
        options = {
          ip = lib.mkOption {
            type = lib.types.str;
            default = "10.0.0.2";
            description = "The local static or leased IP assigned to this machine on the home network.";
          };
          range = lib.mkOption {
            type = lib.types.str;
            default = "10.0.0.0/8";
            description = "The broader subnet block representing the physical home network.";
          };
        };
      };
    };

    wg = lib.mkOption {
      description = "Standard WireGuard VPN tunnel configuration parameters.";
      type = lib.types.submodule {
        options = {
          ip = lib.mkOption {
            type = lib.types.str;
            default = "10.3.0.1";
            description = "The explicit tunnel IP address assigned to this machine's WireGuard interface.";
          };
          range = lib.mkOption {
            type = lib.types.str;
            default = "10.3.0.0/24";
            description = "The total addressable IP space assigned to the WireGuard network pool.";
          };
        };
      };
    };

    hs = lib.mkOption {
      description = "Headscale mesh overlay network configuration parameters.";
      type = lib.types.submodule {
        options = {
          ip = lib.mkOption {
            type = lib.types.str;
            default = "10.4.0.1";
            description = "The explicit mesh network IP address assigned to this machine via Headscale.";
          };
          range = lib.mkOption {
            type = lib.types.str;
            default = "10.4.0.0/24";
            description = "The full mesh overlay allocation subnet block.";
          };
        };
      };
    };
  };

  config = lib.mkIf cfg.enable (
    lib.mkMerge [
      {
        services.resolved.enable = true;
      }

      (lib.mkIf (cfg.profile == "client") {
        networking.networkmanager = {
          enable = true;
          dns = "systemd-resolved";
          wifi.macAddress = "random";
          wifi.backend = "iwd";
          ethernet.macAddress = "random";
        };

        systemd.services."NetworkManager-wait-online".enable = false;

        environment.systemPackages = [
          pkgs.impala
        ];
      })

      (lib.mkIf (cfg.profile == "server") {
        networking = {
          useNetworkd = true;
          useDHCP = false;
        };
        systemd.network = {
          enable = true;

          netdevs."10-br-srv" = {
            netdevConfig = {
              Name = "br-srv";
              Kind = "bridge";
            };
          };
          networks."20-host-management" = {
            matchConfig.Name = "br-srv";
            address = [ "10.0.0.2/24" ];
            gateway = [ "10.0.0.1" ];
            networkConfig.LinkLocalAddressing = "no";
          };
        };
        boot.kernel.sysctl = {
          "net.ipv4.ip_nonlocal_bind" = 1;
        };
      })
    ]
  );
}