{config, ...}: {
  age.secrets.nm-secrets = {
    file = ../../crypto/nm-secrets.age;
    owner = "root";
    group = "root";
  };

  networking = {
    networkmanager = {
      ensureProfiles = {
        environmentFiles = [
          config.age.secrets.nm-secrets.path
        ];

        profiles = {
          Starlink = {
            connection = {
              id = "Starlink";
              type = "wifi";
            };
            ipv4 = {
              method = "auto";
            };
            ipv6 = {
              addr-gen-mode = "stable-privacy";
              method = "auto";
            };
            wifi = {
              mode = "infrastructure";
              ssid = "Starlink";
            };
            wifi-security = {
              key-mgmt = "wpa-psk";
              psk = "$STARLINK_PSK";
            };
          };

          Isopropyl = {
            connection = {
              id = "Isopropyl_sec_notrack";
              type = "wifi";
            };
            ipv4 = {
              method = "auto";
            };
            ipv6 = {
              addr-gen-mode = "stable-privacy";
              method = "auto";
            };
            wifi = {
              mode = "infrastructure";
              ssid = "Isopropyl_sec_notrack";
            };
            wifi-security = {
              key-mgmt = "wpa-psk";
              psk = "$ISOPROPYL_PSK";
            };
          };
        };
      };
    };
  };
}