{

  system = "x86_64-linux";
  nixpkgsStable = true;

  id = 1;
  domain = "fc9f.de";

  sshPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG/7udhktYVZHHZ2RXQeKHt0ACfcG5dmTpyd5LMw4U0O root@nixos";
  wgPublicKey = "J+kRRNU65JGc0yk04v6P3tFwHSQOIfq8EkfD2gFupg4=";

  hardware = {
    cpuVendor = "intel";
    allowHibernation = false;
  };

  networking = {
    ip4IsPrivate = false;
    ip4Address = "194.36.145.49";
    ip4PrefixLength = 22;
    defaultGateway4 = "194.36.144.1";

    ip6IsPrivate = false;
    ip6Address = "2a03:4000:4d:5e::1";
    ip6PrefixLength = 64;

    dn42 = {
      wgPublicKey = "MRXPP//j+BDCiUyrYHdXtdULAsCZyfgumas8pxp6oiE=";
      ip6Address = "fd6b:6174:6a61::1";
      ip6PrefixLength = 48;
    };
  };

  nixosConfiguration =
    { lib, ... }:
    {

      boot.initrd.systemd.emergencyAccess = true;
      boot.kernel.sysctl."net.ipv6.conf.all.proxy_ndp" = true;

      sops.secrets = {
        wgPrivateKey = {
          owner = "systemd-network";
          group = "systemd-network";
        };
      };

      common = {
        profiles.netcup.enable = true;
        configure = {
          primaryNetworkInterface.enable = true;
          rootDisk.swap = {
            enable = true;
            size = "2G";
          };
        };
      };

      zpha = {
        profiles.zaphyra.enable = true;

        websites = {
          "flauschehorn.zaphyra.eu".enable = true;
          "ip.fc9f.de".enable = true;
        };

        configure = {
          dnsServer.enable = true;
          dn42Router.enable = true;
          netcupTunnel = {
            enable = true;
            addresses = lib.singleton "2a03:4000:4d:5e:acab::1/112";
          };
        };
      };
    };

}