{ config, lib, pkgs, ... }: {

    options.sysconfig.opts = {
        
        netbird.enable = lib.options.mkOption {
            type = lib.types.bool;
            default = false;
        };

        virtualization.netbird = {
            enable = lib.options.mkOption {
                type = lib.types.bool;
                default = false;
            };
        };
    };

    config = {

        services.netbird = {
            enable = config.sysconfig.opts.netbird.enable;
        };

        #environment.systemPackages = lib.mkIf config.sysconfig.opts.netbird.enable [ pkgs.netbird-ui ];

        networking.firewall = lib.mkIf config.sysconfig.opts.virtualization.netbird.enable {
            allowedTCPPorts = [ 80 443 33073 33080 10000 ];
            allowedUDPPorts = [ 3478 ];
            allowedUDPPortRanges = [{ from = 49152; to = 65535; }];
        };

        containers.netbird = lib.mkIf config.sysconfig.opts.virtualization.netbird.enable {

            autoStart = true;
            privateNetwork = true;
            hostAddress = "192.168.100.10";
            localAddress = "192.168.100.21";
            forwardPorts = [
                {
                    containerPort = 33073;
                    hostPort = 33073;
                    protocol = "tcp";
                }
                {
                    containerPort = 33080;
                    hostPort = 33080;
                    protocol = "tcp";
                }
                {
                    containerPort = 10000;
                    hostPort = 10000;
                    protocol = "tcp";
                }
                {
                    containerPort = 3478;
                    hostPort = 3478;
                    protocol = "udp";
                }
            ] ++ map (x : {
                containerPort = x;
                hostPort = x;
                protocol = "udp";
            }) (builtins.genList (y: y + 49152) (65535 - 49152));


            bindMounts = {};

            config = {

                networking.firewall = {
                    allowedTCPPorts = [ 80 443 33073 33080 10000 ];
                    allowedUDPPorts = [ 3478 ];
                    allowedUDPPortRanges = [{ from = 49152; to = 65535; }];
                };
                
                services.netbird = {
                    
                    enable = true;

                    server = {
    
                        enable = true;
                        domain = "vpn.blunkall.us";
/*
                        management = {
                            enable = true;
                            dnsDomain = ".vpn";

                            turnDomain = "localhost";

                            disableAnonymousMetrics = true;
                        };

                        dashboard = {
                            enable = true;
                            managementServer = "localhost";
                        };

                        coturn = {
                            domain = "turn.blunkall.us";
                            enable = true;
                        };

                        signal = {
                            enable = true;
                        };
*/
                    };
                };
            };
        };
    };
}