{config, ...}: let
  secrets = config.services.secrets.secrets;
in {
  networking.firewall.trustedInterfaces = ["wg0"];
  networking.wg-quick.interfaces = {
    wg0 = {
      autostart = false;
      address = ["10.69.42.2/32"];
      privateKeyFile = "${secrets.wg_priv.path}";

      peers = [
        # hetzner-vm
        {
          publicKey = "UJr+EmUM7KWkIy0nk0JA38ibvcLC++6iuOKkHdrx9Dc=";
          presharedKeyFile = "${secrets.wg_preshared_hetzner-vm.path}";
          allowedIPs = ["10.69.42.1/32"];
          endpoint = "hetzner-vm.servers.genderfucked.monster:51820";
          persistentKeepalive = 25;
        }
        # vault
        {
          publicKey = "IGq+WanFM/bKNUkwjO/0AAtDhJLvtvU+mVxH27QyHTc=";
          presharedKeyFile = "${secrets.wg_preshared_vault.path}";
          allowedIPs = ["10.69.42.3/32"];
          endpoint = "vault.servers.genderfucked.monster:51820";
          persistentKeepalive = 25;
        }
        # storage
        {
          publicKey = "biNNeCkjAWi2jUVoL5+1pBtXGa3OFZi4DltB2dqGjGg=";
          presharedKeyFile = "${secrets.wg_preshared_storage.path}";
          allowedIPs = ["10.69.42.4/32"];
          endpoint = "storage.servers.genderfucked.monster:51820";
          persistentKeepalive = 25;
        }
      ];
    };
  };
}