{
  config,
  ...
}:
{
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
      80
      443
    ];
    allowedUDPPorts = [
      51820
    ];
  };

  services.namespaced-vpn = {
    enable = true;
    ips = [
      "10.64.244.95/32"
      "fc00:bbbb:bbbb:bb01::1:f45e/128"
    ];
    publicKey = "KkShcqgwbkX2A9n1hhST6qu+m3ldxdJ2Lx8Eiw6mdXw=";
    endpoint = "146.70.117.226:51820";
    privateKeyFile = config.sops.secrets.wireguardKey.path;
  };

  services.storagebox = {
    enable = true;
    hostname = "u491729.your-storagebox.de";
    hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
    user = "u491729";
    sshKeyFile = config.sops.secrets.storageboxKey.path;
    passFile = config.sops.secrets.storageboxCryptKey.path;
  };

  sops = {
    defaultSopsFile = ./hosting-02.yaml;
    secrets = {
      wireguardKey = {
        owner = "root";
      };
      storageboxKey = {
        owner = "root";
      };
      storageboxCryptKey = {
        owner = "root";
      };
    };
  };

  security.acme.defaults.email = "landervandenbulcke@gmail.com";
  security.acme.acceptTerms = true;

  system.stateVersion = "25.05";
}