{ inputs, pkgs, lib, hosts, config, ... }:
let
  inherit (config.networking) hostName;
  inherit (inputs.depot.packages.${pkgs.system}) hyprspace;
  hyprspaceCapableNodes = lib.filterAttrs (_: host: host ? hyprspace) hosts;
  peersFormatted = builtins.mapAttrs (name: x: {
    inherit name;
    inherit (x.hyprspace) id;
    routes = map (net: { inherit net; }) (x.hyprspace.routes or []);
  }) hyprspaceCapableNodes;
  peersFiltered = lib.filterAttrs (name: _: name != hostName) peersFormatted;
  peerList = builtins.attrValues peersFiltered;
  myNode = hosts.${hostName};
  listenPort = myNode.hyprspace.listenPort or 8001;

  interfaceConfig = pkgs.writeText "hyprspace.json" (builtins.toJSON {
    listenAddresses = let
      port = toString listenPort;
    in [
      "/ip4/0.0.0.0/tcp/${port}"
      "/ip4/0.0.0.0/udp/${port}/quic-v1"
      "/ip6/::/tcp/${port}"
      "/ip6/::/udp/${port}/quic-v1"
    ];
    privateKey = "@HYPRSPACEPRIVATEKEY@";
    peers = peerList;
  });

  privateKeyFile = config.age.secrets.hyprspace-key.path;
  runConfig = "/run/hyprspace.json";
in {
  age.secrets.hyprspace-key = {
    file = ../../secrets/hyprspace-key- + "${hostName}.age";
    mode = "0400";
  };
  environment.systemPackages = [
    hyprspace
  ];
  systemd.services.hyprspace = {
    enable = true;
    wantedBy = [ "multi-user.target" ];
    wants = [ "network-online.target" ];
    after = [ "network-online.target" ];
    preStart = ''
      test -e ${runConfig} && rm ${runConfig}
      cp ${interfaceConfig} ${runConfig}
      chmod 0600 ${runConfig}
      ${pkgs.replace-secret}/bin/replace-secret '@HYPRSPACEPRIVATEKEY@' "${privateKeyFile}" ${runConfig}
      chmod 0400 ${runConfig}
    '';
    environment = lib.optionalAttrs config.services.kubo.enable {
      HYPRSPACE_IPFS_API = config.services.kubo.settings.Addresses.API;
    };
    serviceConfig = {
      Group = "wheel";
      Restart = "on-failure";
      RestartSec = "5s";
      ExecStart = "${hyprspace}/bin/hyprspace up -c ${runConfig}";
      ExecStopPost = "${pkgs.coreutils}/bin/rm -f /run/hyprspace-rpc.hyprspace.sock";
      ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
    };
  };
  networking.firewall = {
    allowedTCPPorts = [ listenPort ];
    allowedUDPPorts = [ listenPort ];
    trustedInterfaces = [ "hyprspace" ];
  };
  networking.networkmanager.dispatcherScripts = [{
    source = pkgs.writeShellScript "hyprspace-reconnect.sh" ''
      [[ "$2" != "up" ]] && exit 0
      PATH=${pkgs.systemd}/bin:$PATH
      case $1 in
        wl*|en*)
          systemctl reload-or-restart --no-block hyprspace.service;;
      esac
      exit 0
    '';
    type = "basic";
  }];
}