{
  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-20.03";
  outputs = { self, nixpkgs }: {
    nixosConfigurations.container = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        ({ pkgs, ... }@inputs:
          import ./configuration.nix (inputs // { flake = self; }))
      ];
    };
  };
}

{
  "nodes": {
    "nixpkgs": {
      "locked": {
        "lastModified": 1620055814,
        "narHash": "sha256-8LEHoYSJiL901bTMVatq+rf8y7QtWuZhwwpKE2fyaRY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "1db42b7fe3878f3f5f7a4f2dc210772fd080e205",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "ref": "nixos-20.03",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
        "nixpkgs": "nixpkgs"
      }
    }
  },
  "root": "root",
  "version": 7
}

({ pkgs, flake, ... }: {
  boot.isContainer = true;
  # Let 'nixos-version --json' know about the Git revision
  # of this flake.
  system.configurationRevision = pkgs.lib.mkIf (flake ? rev) flake.rev;
  environment.systemPackages = with pkgs; [ wireguard ];
  # Network configuration.
  networking.useDHCP = false;
  networking.firewall.allowedUDPPorts = [ 51820 ];
  networking.nat.enable = true;
  networking.nat.externalInterface = "wlan0";
  networking.nat.internalInterfaces = [ "wg0" ];
  networking.wireguard.interfaces = {
    wg0 = {
      ips = [ "10.0.0.1/24" ];
      listenPort = 51820;
      postSetup = ''
        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
      '';
      postShutdown = ''
        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
      '';
      privateKeyFile = ".private";
      peers = [{
        publicKey = "mkH6f0LZM8oiMw6bRVkzhcw/OibwtENkR0WnQZYz1nQ=";
        allowedIPs = [ "10.1.0.0/32" ];
      }];
    };
  };
})