1{den, ...}: {
  2  den.hosts.tribios = {
  3    address = {
  4      ipv4.tailscale = "100.127.6.231";
  5      ipv6.tailscale = "fd7a:115c:a1e0:675d:6820:4fa0:fddc:a59";
  6    };
  7    settings.services.mihomo = {
  8      autoStart = true;
  9      tailscaleWebControl = true;
 10      interfaces = {
 11        wan = "enP3p49s0";
 12        lan = ["br-lan"];
 13      };
 14    };
 15  };
 16
 17  den.aspects.tribios = {
 18    includes = [
 19      den.aspects.services.mihomo
 20      den.aspects.services.mihomo.tproxy
 21    ];
 22
 23    nixos = {
 24      boot.kernel.sysctl = {
 25        "net.ipv4.ip_forward" = 1;
 26        "net.ipv4.conf.all.send_redirects" = 0;
 27        "net.ipv4.conf.default.send_redirects" = 0;
 28        "net.ipv4.conf.br-lan.send_redirects" = 0;
 29        "net.ipv6.conf.all.forwarding" = 1;
 30        "net.ipv6.conf.br-lan.forwarding" = 1;
 31      };
 32
 33      # Tribios' network interfaces:
 34      # wan: enP3p49s0 (2.5Gbps)
 35      # lan: enP4p65s0 (2.5Gbps), end0 (1.0Gbps)
 36      # Automatically configurated by nixos-factor.
 37      networking = {
 38        useNetworkd = true;
 39        bridges = {
 40          br-lan = {
 41            interfaces = ["enP4p65s0" "end0"];
 42          };
 43        };
 44        interfaces = {
 45          br-lan = {
 46            useDHCP = false;
 47            ipv4.addresses = [
 48              {
 49                address = "192.168.52.1";
 50                prefixLength = 24;
 51              }
 52            ];
 53          };
 54        };
 55
 56        firewall = {
 57          enable = true;
 58          trustedInterfaces = ["br-lan"];
 59        };
 60
 61        nat = {
 62          enable = true;
 63          internalInterfaces = ["br-lan"];
 64          externalInterface = "enP3p49s0";
 65        };
 66      };
 67
 68      # NAT-PMP for Tailscale NAT traversal.
 69      # Tailscale clients behind this router will auto-request
 70      # endpoint-independent port mappings, enabling direct
 71      # connections from the company network (192.168.100.x).
 72      services.miniupnpd = {
 73        enable = true;
 74        externalInterface = "enP3p49s0";
 75        internalIPs = ["br-lan"];
 76        upnp = false;
 77        natpmp = true;
 78      };
 79
 80      systemd.services.miniupnpd.after = ["systemd-networkd.service"];
 81
 82      services.kea.dhcp4 = {
 83        enable = true;
 84        settings = {
 85          interfaces-config.interfaces = ["br-lan"];
 86          lease-database = {
 87            name = "/var/lib/kea/dhcp4.leases";
 88            persist = true;
 89            type = "memfile";
 90          };
 91          valid-lifetime = 4000;
 92          subnet4 = [
 93            {
 94              id = 1;
 95              subnet = "192.168.52.0/24";
 96              pools = [{pool = "192.168.52.2 - 192.168.52.200";}];
 97              option-data = [
 98                {
 99                  name = "routers";
100                  data = "192.168.52.1";
101                }
102                {
103                  name = "domain-name-servers";
104                  data = "223.5.5.5, 119.29.29.29";
105                }
106              ];
107            }
108          ];
109        };
110      };
111    };
112  };
113}