1{den, ...}: {
  2  den.hosts.tribios = {
  3    address = {
  4      ipv4.tailscale = "100.64.21.193";
  5      ipv6.tailscale = "fd7a:115c:a1e0:b5a:53e4:e124:a3ac:614c";
  6    };
  7    settings.services.proxy.dae.interfaces = {
  8      wan = ["auto"];
  9      lan = ["br-lan"];
 10    };
 11  };
 12
 13  den.aspects.tribios = {
 14    includes = [
 15      den.aspects.services.proxy
 16    ];
 17
 18    nixos = {
 19      boot.kernel.sysctl = {
 20        "net.ipv4.ip_forward" = 1;
 21        "net.ipv4.conf.all.send_redirects" = 0;
 22        "net.ipv4.conf.default.send_redirects" = 0;
 23        "net.ipv4.conf.br-lan.send_redirects" = 0;
 24        "net.ipv6.conf.all.forwarding" = 1;
 25        "net.ipv6.conf.br-lan.forwarding" = 1;
 26      };
 27
 28      # Tribios' network interfaces:
 29      # wan: enP3p49s0 (2.5Gbps)
 30      # lan: enP4p65s0 (2.5Gbps), end0 (1.0Gbps)
 31      # Automatically configurated by nixos-factor.
 32      networking = {
 33        useNetworkd = true;
 34        bridges = {
 35          br-lan = {
 36            interfaces = ["enP4p65s0" "end0"];
 37          };
 38        };
 39        interfaces = {
 40          br-lan = {
 41            useDHCP = false;
 42            ipv4.addresses = [
 43              {
 44                address = "192.168.52.1";
 45                prefixLength = 24;
 46              }
 47            ];
 48          };
 49        };
 50
 51        firewall = {
 52          enable = true;
 53          trustedInterfaces = ["br-lan"];
 54        };
 55
 56        nat = {
 57          enable = true;
 58          internalInterfaces = ["br-lan"];
 59          externalInterface = "enP3p49s0";
 60        };
 61      };
 62
 63      # NAT-PMP for Tailscale NAT traversal.
 64      # Tailscale clients behind this router will auto-request
 65      # endpoint-independent port mappings, enabling direct
 66      # connections from the company network (192.168.100.x).
 67      services.miniupnpd = {
 68        enable = true;
 69        externalInterface = "enP3p49s0";
 70        internalIPs = ["br-lan"];
 71        upnp = false;
 72        natpmp = true;
 73      };
 74
 75      services.kea.dhcp4 = {
 76        enable = true;
 77        settings = {
 78          interfaces-config.interfaces = ["br-lan"];
 79          lease-database = {
 80            name = "/var/lib/kea/dhcp4.leases";
 81            persist = true;
 82            type = "memfile";
 83          };
 84          valid-lifetime = 4000;
 85          subnet4 = [
 86            {
 87              id = 1;
 88              subnet = "192.168.52.0/24";
 89              pools = [{pool = "192.168.52.2 - 192.168.52.200";}];
 90              option-data = [
 91                {
 92                  name = "routers";
 93                  data = "192.168.52.1";
 94                }
 95                {
 96                  name = "domain-name-servers";
 97                  data = "223.5.5.5, 119.29.29.29";
 98                }
 99              ];
100            }
101          ];
102        };
103      };
104    };
105  };
106}