{
  config,
  pkgs,
  lib,
  ...
}: {
  networking = {
    hostName = "debian-4gb-fsn1-1";
    domain = "severijnse.eu";
    useDHCP = true;
    dhcpcd.enable = true;
    nameservers = [
      "2a01:4ff:ff00::add:2"
      "2a01:4ff:ff00::add:1"
      "185.12.64.2"
    ];
    search = ["severijnse.eu"];
    interfaces."enp1s0" = {
      ipv6.addresses = [
        {
          address = "2a01:4f8:c014:2585::1";
          prefixLength = 64;
        }
      ];
      ipv6.routes = [
        {
          address = "::";
          prefixLength = 0;
          via = "fe80::1";
        }
      ];
    };
    firewall = {
      enable = true;
      allowedTCPPorts = [
        22 # SSH
        53 # DNS (CoreDNS)
        80 # HTTP (Caddy)
        443 # HTTPS (Caddy)
        465 # SMTP over TLS
        587 # SMTP (STARTTLS)
        993 # IMAP over TLS
        143 # IMAP
        25 # SMTP
        222 # Gitea SSH
        51821 # WG-Easy web UI
      ];
      allowedUDPPorts = [
        53 # DNS
        51820 # WireGuard
      ];
    };
    nat = {
      enable = true;
      externalInterface = "enp1s0";
      internalInterfaces = ["wg0"];
    };
  };

  boot.kernel.sysctl = {
    "net.ipv4.ip_forward" = 1;
    "net.ipv4.conf.all.src_valid_mark" = 1;
    "net.ipv6.conf.all.forwarding" = 1;
  };
}
