{ config, lib, ... }:
let
  cfg = config.router;
  lans = lib.attrValues cfg.lans;
in
{
  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = lans != [ ];
        message = "router: at least one LAN must be defined.";
      }
      {
        assertion = lib.any (l: l.allowManagement) lans;
        message = "router: no LAN has allowManagement = true; you would be locked out of the router.";
      }
      {
        assertion = !(lib.elem cfg.wan.interface (map (l: l.interface) lans));
        message = "router: the WAN interface `${cfg.wan.interface}` is also used by a LAN.";
      }
      {
        assertion =
          let
            ifaces = map (l: l.interface) lans;
          in
          lib.length ifaces == lib.length (lib.unique ifaces);
        message = "router: two LANs share the same interface.";
      }
    ];
  };
}