{
  config,
  lib,
  pkgs,
  masterDomain,
  ...
}:
let
  cfg = config.os.srv.headscale;
  aclPolicy = pkgs.writeText "headscale-policy.json" (
    builtins.toJSON {
      groups = {
        "group:admin" = [ "your-device-name" ];
        "group:friends" = [ "friend-device-name" ];
      };

      hosts = {
        "server" = "10.4.0.1";
      };

      acls = [
        {
          action = "accept";
          src = [ "group:admin" ];
          dst = [ "*:*" ];
        }

        {
          action = "accept";
          src = [ "group:friends" ];
          dst = [
            "server:18080"
            "server:18081"
            "server:25565"
          ];
        }
      ];
    }
  );
in
{
  options.os.srv.headscale.enable = lib.mkEnableOption "enables headscales";

  config = lib.mkIf cfg.enable {
    services.headscale = {
      enable = true;
      address = "127.0.0.1";
      port = 8080;

      settings = {
        server_url = "https://vpn.${masterDomain}";

        policy.path = "${aclPolicy}";

        dns = {
          magic_dns = true;
          base_domain = "vpn";
          nameservers = [ config.os.core.network.ips.vm2-gateway ];
        };

        ip_prefixes = [
          "10.4.0.0/16"
        ];
      };
    };

    services.nginx.virtualHosts."vpn.${masterDomain}" = {
      enableACME = true;
      forceSSL = true;
      locations."/" = {
        proxyPass = "http://127.0.0.1:8080";
        proxyWebsockets = true;
      };
    };
  };
}