1{lib, ...}: {
 2  den.aspects.services.mihomo.tun = {
 3    nixos = {
 4      host,
 5      config,
 6      ...
 7    }: let
 8      cfg = host.settings.services.mihomo;
 9    in {
10      services.mihomo = {
11        tunMode = true;
12        config = {
13          tun = {
14            enable = true;
15            stack = "mixed";
16            device = "mihomo-tun0";
17            auto-route = true;
18            auto-redirect = true;
19            auto-detect-interface = false;
20            dns-hijack = [
21              "any:53"
22              "tcp://any:53"
23            ];
24            strict-route = true;
25            mtu = 1500;
26            include-interface = ["lo"] ++ [cfg.interfaces.wan] ++ cfg.interfaces.lan;
27            route-exclude-address = [
28              "192.168.0.0/16"
29              "10.0.0.0/8"
30              "172.16.0.0/12"
31              # Tailscale
32              "100.64.0.0/10"
33              "fd7a:115c:a1e0::/48"
34            ];
35          };
36        };
37      };
38
39      networking.firewall.trustedInterfaces = lib.mkIf config.services.mihomo.tunMode [config.services.mihomo.config.tun.device];
40    };
41  };
42}