{
  config,
  lib,
  pkgs,
  ...
}:

{
  # WireGuard — not started on boot, use `wg-quick up wg0` / `wg-quick down wg0`
  # Private key must be placed at /etc/wireguard/wg0.key (mode 600, owned by root)
  networking.wg-quick.interfaces.wg0 = {
    autostart = false;
    address = [ "10.67.40.2/32" ];
    privateKeyFile = "/etc/wireguard/wg0.key";
    peers = [
      {
        publicKey = "wg37lctIxY4qbcyjVDrEI4mahH2Bhgv+73djEjJSyww=";
        endpoint = "vpn.soltermann.xyz:51820";
        allowedIPs = [ "10.67.40.0/24" ];
        persistentKeepalive = 25;
      }
    ];
  };

  programs.bash.shellAliases = {
    vpn-up = "sudo systemctl start wg-quick-wg0";
    vpn-down = "sudo systemctl stop wg-quick-wg0";
  };

  programs.fish.shellAliases = {
    vpn-up = "sudo systemctl start wg-quick-wg0";
    vpn-down = "sudo systemctl stop wg-quick-wg0";
  };

  home-manager.users.christian.custom.xmobarVpn = true;
}