{ config, lib, ... }:
let
  cfg = config.router;
in
{
  config = lib.mkIf cfg.enable {
    networking.useNetworkd = true;
    networking.useDHCP = false;

    boot.kernel.sysctl = {
      "net.ipv4.conf.all.forwarding" = 1;
    };

    systemd.network.networks = {
      "10-wan" = {
        matchConfig.Name = cfg.wan.interface;
        networkConfig.DHCP = "ipv4";
        # The router runs its own resolver; never adopt the ISP's DNS for the host.
        dhcpV4Config.UseDNS = false;
      };
    } // lib.mapAttrs' (
      name: lan:
      lib.nameValuePair "20-lan-${name}" {
        matchConfig.Name = lan.interface;
        address = [ "${lan.ipv4.address}/${toString lan.ipv4.prefixLength}" ];
        networkConfig.ConfigureWithoutCarrier = true;
      }
    ) cfg.lans;
  };
}