{ lib, pkgs, ... }:

let
  wifi = "wlp0s26u1u2";
  ipAddress = "10.23.45.1";
  prefixLength = 24;
  servedAddressRange = "10.23.45.2,10.23.45.150,12h";
  ssid = "palosiot";
  wifiPassword = lib.fileContents <secrets/iot_wifi>;

in {

  # todo only open needed ports
  networking.firewall.trustedInterfaces = [ wifi ];

  networking.networkmanager.unmanaged = [ wifi ];
  networking.dhcpcd.denyInterfaces = [ wifi ];

  networking.interfaces."${wifi}".ipv4.addresses = [{
    address = ipAddress;
    prefixLength = prefixLength;
  }];

  systemd.services.hostapd = {
    description = "hostapd wireless AP";
    path = [ pkgs.hostapd ];
    wantedBy = [ "network.target" ];

    after = [
      "${wifi}-cfg.service"
      "nat.service"
      "bind.service"
      "dhcpd.service"
      "sys-subsystem-net-devices-${wifi}.device"
    ];

    serviceConfig = {
      ExecStart = "${pkgs.hostapd}/bin/hostapd ${
          pkgs.writeText "hostapd.conf" ''
            interface=${wifi}
            hw_mode=g
            channel=10
            ieee80211d=1
            country_code=DE
            ieee80211n=1
            wmm_enabled=1

            ssid=${ssid}
            auth_algs=1
            wpa=2
            wpa_key_mgmt=WPA-PSK
            rsn_pairwise=CCMP
            wpa_passphrase=${wifiPassword}
          ''
        }";
      Restart = "always";
    };
  };

  services.dnsmasq = {
    enable = true;
    extraConfig = ''
      # Only listen to routers' LAN NIC.  Doing so opens up tcp/udp port 53 to
      # localhost and udp port 67 to world:
      interface=${wifi}

      # Explicitly specify the address to listen on
      listen-address=${ipAddress}

      # Dynamic range of IPs to make available to LAN PC and the lease time.
      # Ideally set the lease time to 5m only at first to test everything works okay before you set long-lasting records.
      dhcp-range=${servedAddressRange}
    '';
  };

}