1{den, ...}: {
  2  den.hosts.tribios = {
  3    address = {
  4      ipv4.tailscale = "100.127.6.231";
  5      ipv6.tailscale = "fd7a:115c:a1e0:675d:6820:4fa0:fddc:a59";
  6    };
  7    settings.services.proxy.mihomo = {
  8      autoStart = true;
  9      tailscaleWebControl = true;
 10      interfaces = {
 11        wan = "enP3p49s0";
 12        lan = ["br-lan"];
 13      };
 14    };
 15  };
 16
 17  den.aspects.tribios = {
 18    includes = [
 19      den.aspects.services.proxy.mihomo
 20      den.aspects.services.proxy.mihomo.tproxy
 21    ];
 22
 23    nixos = {
 24      systemd.services.mihomo.after = ["systemd-networkd.service"];
 25
 26      boot.kernel.sysctl = {
 27        "net.ipv4.ip_forward" = 1;
 28        "net.ipv4.conf.all.send_redirects" = 0;
 29        "net.ipv4.conf.default.send_redirects" = 0;
 30        "net.ipv4.conf.br-lan.send_redirects" = 0;
 31        "net.ipv6.conf.all.forwarding" = 1;
 32        "net.ipv6.conf.br-lan.forwarding" = 1;
 33      };
 34
 35      # Tribios' network interfaces:
 36      # wan: enP3p49s0 (2.5Gbps)
 37      # lan: enP4p65s0 (2.5Gbps), end0 (1.0Gbps)
 38      # Automatically configurated by nixos-factor.
 39      networking = {
 40        useNetworkd = true;
 41        bridges = {
 42          br-lan = {
 43            interfaces = ["enP4p65s0" "end0"];
 44          };
 45        };
 46        interfaces = {
 47          br-lan = {
 48            useDHCP = false;
 49            ipv4.addresses = [
 50              {
 51                address = "192.168.52.1";
 52                prefixLength = 24;
 53              }
 54            ];
 55          };
 56        };
 57
 58        firewall = {
 59          enable = true;
 60          trustedInterfaces = ["br-lan"];
 61        };
 62
 63        nat = {
 64          enable = true;
 65          internalInterfaces = ["br-lan"];
 66          externalInterface = "enP3p49s0";
 67        };
 68      };
 69
 70      # NAT-PMP for Tailscale NAT traversal.
 71      # Tailscale clients behind this router will auto-request
 72      # endpoint-independent port mappings, enabling direct
 73      # connections from the company network (192.168.100.x).
 74      services.miniupnpd = {
 75        enable = true;
 76        externalInterface = "enP3p49s0";
 77        internalIPs = ["br-lan"];
 78        upnp = false;
 79        natpmp = true;
 80      };
 81
 82      systemd.services.miniupnpd.after = ["systemd-networkd.service"];
 83
 84      services.kea.dhcp4 = {
 85        enable = true;
 86        settings = {
 87          interfaces-config.interfaces = ["br-lan"];
 88          lease-database = {
 89            name = "/var/lib/kea/dhcp4.leases";
 90            persist = true;
 91            type = "memfile";
 92          };
 93          valid-lifetime = 4000;
 94          subnet4 = [
 95            {
 96              id = 1;
 97              subnet = "192.168.52.0/24";
 98              pools = [{pool = "192.168.52.2 - 192.168.52.200";}];
 99              option-data = [
100                {
101                  name = "routers";
102                  data = "192.168.52.1";
103                }
104                {
105                  name = "domain-name-servers";
106                  data = "223.5.5.5, 119.29.29.29";
107                }
108              ];
109            }
110          ];
111        };
112      };
113    };
114  };
115}