{
  config,
  lib,
  ...
}:
let
  cfg = config.os.srv.yggdrasil;
in
{
  options.os.srv.yggdrasil.enable = lib.mkEnableOption "enables yggdrasil";

  config = lib.mkIf cfg.enable {
    services = {
      yggdrasil = {
        enable = true;
        openMulticastPort = true;

        settings = {
          PrivateKeyPath = config.sops.secrets."yggdrasil-private-key".path;
          IfName = "ygg0";
          NodeInfoPrivacy = true;
          Peers = [
            "tcp://ip6.fvm.mywire.org:8080?key=000000000143db657d1d6f80b5066dd109a4cb31f7dc6cb5d56050fffb014217"
            "tcp://ygg1.mk16.de:1337?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a"
            "tcp://62.210.85.80:39565"

            "tls://ygg1.mk16.de:1338?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a"
            "tls://103.109.234.106:443?key=000000035621c71b5610434589df051aed2688510f904ae79860668dc0fbf182"
            "tls://s2.i2pd.xyz:39575"

            "quic://ygg1.mk16.de:1339?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a"
            "quic://ygg6.mk16.de:1339?key=0000005e5ced06fd4d465bc651c5deb6d70cbe82d36efb68c0450268eaaa5384"
            "quic://[2a0b:4142:e9e::2]:65535"
          ];
          Listen = [
            "tls://0.0.0.0:0"
            "tcp://[::]:9001"
          ];
        };
      };
      yggdrasil-jumper.enable = true;
    };
  };
}