{ config, pkgs, ... }:
{
  # Uplink war bis 12.09.2026 der Mango-Router, ist seit der Migration
  # (docs/pinix-router-migration.md) das Nokia 6300 per USB-Tethering.
  # NAT66 macht pinix' beobachtete Quelladresse die jeweils aktuelle
  # oeffentliche IPv6 des Telefons. Reuse des bestehenden verschluesselten
  # DNS-Tokens; kein Token auf dem Router noetig.
  systemd.services.wan-dns-update = {
    description = "Update WAN IPv6 DNS for web and remote SSH";
    wants = [ "network-online.target" ];
    after = [ "network-online.target" ];
    path = [ pkgs.bash pkgs.curl pkgs.jq ];
    script = "bash ${../../../scripts/update-wan-dns.sh}";
    serviceConfig = {
      Type = "oneshot";
      EnvironmentFile = config.age.secrets.traefik.path;
      DynamicUser = true;
      NoNewPrivileges = true;
      ProtectSystem = "strict";
      ProtectHome = true;
      PrivateTmp = true;
      TimeoutStartSec = "100s";
    };
  };
  systemd.timers.wan-dns-update = {
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnBootSec = "30s";
      OnUnitInactiveSec = "60s";
      AccuracySec = "5s";
    };
  };
}