{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.os.srv.vpn;
  netCfg = config.os.core.network;
in
{
  options.os.srv.vpn.enable = lib.mkEnableOption "enables vpn stuff";

  config = lib.mkIf (cfg.enable && netCfg.enable) {
    networking.networkmanager.ensureProfiles = {
      environmentFiles = [ config.sops.secrets."vpn/warp_private_key".path ];
      profiles.cloudflare-warp = {
        connection = {
          id = "cloudflare-warp";
          type = "wireguard";
          interface-name = "wg0";
          autoconnect = false;
        };
        wireguard = {
          mtu = 1200;
          private-key = "$WG_KEY";
        };
        "wireguard-peer.bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=" = {
          endpoint = "engage.cloudflareclient.com:2408";
          allowed-ips = "0.0.0.0/0;::/0;";
        };
        ipv4 = {
          method = "manual";
          address1 = "172.16.0.2/32";
          dns = "1.1.1.1;1.0.0.1;";
        };
        ipv6 = {
          method = "manual";
          address1 = "2606:4700:110:84c7:36c4:e444:5efb:b108/128";
          dns = "2606:4700:4700::1111;2606:4700:4700::1001;";
        };
      };
    };
    environment.systemPackages = with pkgs; [
      wgcf
      wireguard-tools
    ];
  };
}