{
  lib,
  config,
  pkgs,
  ...
}: let
  cfg = config.myConfig.wifi;
in {
  options.myConfig.wifi = {
    enable = lib.mkEnableOption "wifi";
    tray = lib.mkEnableOption "nm tray entry";
  };

  config = lib.mkIf cfg.enable {
    environment.etc = let
      template = config.sops.templates;
      base = "NetworkManager/system-connections";
    in {
      "${base}/home.nmconnection".source = template."home.nmconnection".path;
      "${base}/parents.nmconnection".source = template."parents.nmconnection".path;
      "${base}/eduroam.nmconnection".source = template."eduroam.nmconnection".path;
      "${base}/luhbots.nmconnection".source = template."luhbots.nmconnection".path;
      "${base}/luhbots5.nmconnection".source = template."luhbots5.nmconnection".path;
    };
    networking.networkmanager.enable = true;

    environment.systemPackages = lib.optional cfg.tray pkgs.nm-tray;

    myConfig.sops.enable = true;
    sops = {
      secrets = {
        "home/ssid" = {
          sopsFile = ../../secrets/wifi.yaml;
        };
        "home/psk" = {
          sopsFile = ../../secrets/wifi.yaml;
        };
        "parents/ssid" = {
          sopsFile = ../../secrets/wifi.yaml;
        };
        "parents/psk" = {
          sopsFile = ../../secrets/wifi.yaml;
        };
        "eduroam/ident" = {
          sopsFile = ../../secrets/wifi.yaml;
        };
        "eduroam/psk" = {
          sopsFile = ../../secrets/wifi.yaml;
        };
        "luhbots/ssid" = {
          sopsFile = ../../secrets/wifi.yaml;
        };
        "luhbots/ssid5" = {
          sopsFile = ../../secrets/wifi.yaml;
        };
        "luhbots/psk" = {
          sopsFile = ../../secrets/wifi.yaml;
        };
      };
      templates = let
        placeholder = config.sops.placeholder;
      in {
        "home.nmconnection".content = ''
          [connection]
          id=${placeholder."home/ssid"}
          type=wifi
          autoconnect-priority=10

          [wifi]
          mode=infrastructure
          ssid=${placeholder."home/ssid"}

          [wifi-security]
          key-mgmt=wpa-psk
          psk=${placeholder."home/psk"}
        '';
        "parents.nmconnection".content = ''
          [connection]
          id=${placeholder."parents/ssid"}
          type=wifi
          autoconnect-priority=10

          [wifi]
          mode=infrastructure
          ssid=${placeholder."parents/ssid"}

          [wifi-security]
          key-mgmt=wpa-psk
          psk=${placeholder."parents/psk"}
        '';
        "eduroam.nmconnection".content = ''
          [connection]
          id=eduroam
          type=wifi
          autoconnect-priority=0

          [wifi]
          mode=infrastructure
          ssid=eduroam

          [wifi-security]
          auth-alg=open
          key-mgmt=wpa-eap

          [802-1x]
          anonymous-identity=anonymous@uni-hannover.de
          ca-cert=${./T-TeleSec_GlobalRoot_Class_2.crt}
          domain-suffix-match=radius-dfn.luis.uni-hannover.de
          eap=ttls;
          identity=${placeholder."eduroam/ident"}
          password=${placeholder."eduroam/psk"}
          phase2-auth=mschapv2
        '';
        "luhbots.nmconnection".content = ''
          [connection]
          id=${placeholder."luhbots/ssid"}
          type=wifi
          autoconnect-priority=5

          [wifi]
          mode=infrastructure
          ssid=${placeholder."luhbots/ssid"}
          autoconnect-priority=0

          [wifi-security]
          key-mgmt=wpa-psk
          psk=${placeholder."luhbots/psk"}
        '';
        "luhbots5.nmconnection".content = ''
          [connection]
          id=${placeholder."luhbots/ssid5"}
          type=wifi
          autoconnect-priority=10

          [wifi]
          mode=infrastructure
          ssid=${placeholder."luhbots/ssid5"}
          autoconnect-priority=0

          [wifi-security]
          key-mgmt=wpa-psk
          psk=${placeholder."luhbots/psk"}
        '';
      };
    };
  };
}
