{ config, lib, host, secrets, ... }:
{
  sops.secrets = {
    "wireless-networking.env" = {};
  };

  networking = {
    nameservers = [
      "1.1.1.1"
      "8.8.8.8"
    ];
    hostName = host;
    networking.networkmanager = {
      enable = true;
    };
    enableIPv6 = false;
    firewall.allowedTCPPorts = [ 
      80
      443
    ];
    wireless = {
      enable = true;
      environmentFile = config.sops.secrets."wireless-networking.env";
      networks = {
        eduroam = lib.mkIf (host == "NxXPS") {
          auth = ''
            ssid="eduroam"
            key_mgmt=WPA-EAP
            eap=PEAP
            identity=${secrets.email.tuda.tuid}lan01@tu-darmstadt.de
            password="@NXXPSEDUROAMPW@"
            domain_suffix_match="radius.hrz.tu-darmstadt.de"
            anonymous_identity="eduroam@tu-darmstadt.de"
            phase2="auth=MSCHAPV2"
            ca_cert="/etc/ssl/certs/ca-bundle.crt"
          '';
        };
      };
    };
  };
}