{ config, lib, pkgs, ... }:
{
  # Gefunden am 13.09.2026: end0 und wlan0 landen ohne erkennbare erzeugende
  # Ursache (weder NixOS' Netzwerk-Modul noch dhcpcd.denyInterfaces treffen
  # zu) mit addr_gen_mode=none hoch -- ohne automatisch erzeugte
  # Link-Local-Adresse verweigert radvd stillschweigend jede Advertisement
  # ("interface is not ready" im Debug-Log), WLAN-Clients bekommen also nie
  # eine Standardroute. Manuell mit `ip link set dev <if> addrgenmode eui64`
  # reproduzierbar behoben; dieser Dienst macht das bei jedem Boot, nach
  # allem, was die Interfaces sonst anfasst.
  systemd.services.pinix-lan-linklocal = {
    description = "Restore auto-generated link-local addresses on end0/wlan0 for radvd";
    wantedBy = [ "multi-user.target" ];
    after = [
      "network-addresses-end0.service"
      "network-addresses-wlan0.service"
      "dhcpcd.service"
    ];
    wants = [
      "network-addresses-end0.service"
      "network-addresses-wlan0.service"
    ];
    before = [ "radvd.service" ];
    serviceConfig.Type = "oneshot";
    path = [ pkgs.iproute2 ];
    script = ''
      ip link set dev end0 addrgenmode eui64
      ip link set dev wlan0 addrgenmode eui64
    '';
  };
  systemd.services.radvd.after = [ "pinix-lan-linklocal.service" ];
  systemd.services.radvd.wants = [ "pinix-lan-linklocal.service" ];

  networking.wireless.enable = lib.mkForce false;
  networking.interfaces = {
    end0.ipv6.addresses = [ { address = "fd42:50:0::1"; prefixLength = 64; } ];
    wlan0 = {
      useDHCP = lib.mkForce false;
      ipv4.addresses = [ { address = "192.168.51.1"; prefixLength = 24; } ];
      ipv6.addresses = [ { address = "fd42:50:1::1"; prefixLength = 64; } ];
    };
  };
  boot.kernel.sysctl = {
    "net.ipv6.conf.end0.accept_ra" = 0;
    "net.ipv6.conf.wlan0.accept_ra" = 0;
  };
  networking.nat = {
    enable = true;
    enableIPv6 = true;
    externalInterface = "wan0";
    internalInterfaces = [ "end0" "wlan0" ];
    internalIPv6s = [ "fd42:50::/48" ];
  };
  networking.firewall.interfaces.wlan0 = {
    allowedTCPPorts = [ 22 53 ];
    allowedUDPPorts = [ 53 67 ];
  };

  age.secrets.pinix-wifi.file = ../../secrets/pinix-wifi.age;
  services.hostapd = {
    enable = true;
    radios.wlan0 = {
      countryCode = "DE";
      band = "2g";
      channel = 6;
      networks.wlan0 = {
        ssid = "pinix";
        authentication = {
          # wpa2-sha256 (HMAC-SHA256 key derivation) statt des ueblichen
          # wpa2-sha1 (Standard-WPA2-PSK trotz des Namens) verhinderte am
          # 13.09.2026 den Beitritt eines iPad -- die Anfrage kam serverseitig
          # nie an, hostapd loggte nichts. wpa2-sha1 ist der Modus, den
          # praktisch jedes Geraet unterstuetzt.
          mode = "wpa2-sha1";
          wpaPasswordFile = config.age.secrets.pinix-wifi.path;
        };
      };
    };
  };
  services.dnsmasq = {
    enable = true;
    settings = {
      port = 0;
      interface = "wlan0";
      bind-dynamic = true;
      dhcp-authoritative = true;
      dhcp-range = "192.168.51.50,192.168.51.200,255.255.255.0,12h";
      # Local IPv4 only. Internet uses IPv6 + Telekom NAT64/DNS64.
      dhcp-option = [ "option:router" "option:dns-server,192.168.51.1" ];
    };
  };
  services.radvd = {
    enable = true;
    config = ''
      interface end0 {
        AdvSendAdvert on;
        MaxRtrAdvInterval 30;
        prefix fd42:50:0::/64 { AdvOnLink on; AdvAutonomous on; };
        RDNSS fd42:50:0::1 {};
      };
      interface wlan0 {
        AdvSendAdvert on;
        MaxRtrAdvInterval 30;
        prefix fd42:50:1::/64 { AdvOnLink on; AdvAutonomous on; };
        RDNSS fd42:50:1::1 {};
      };
    '';
  };
}