{ pkgs, lib, config, ... }:
{
  environment.systemPackages = [
    (pkgs.writeShellApplication {
      name = "install-wifi";
      text = ''
        temp="$(mktemp --directory --suffix="-install-wifi")"
        cd "$temp"
        ${
          pkgs.writers.writePython3 "install-wifi-import" {
            libraries = [ pkgs.python3Packages.pyaml ];
          } (builtins.readFile ./import.py)
        }
        sudo chown root:root wireless_networks.{env,json}
        sudo chmod "u=r" wireless_networks.env
        sudo chmod "u=r,g=r,o=r" wireless_networks.json
        sudo mkdir -p /etc/keys
        sudo mv -f wireless_networks.{env,json} /etc/keys
        cd -
        rmdir "$temp"
        rb
      '';
      # This relies on multiple off-repo things:
      # - pass password store with wifi/${name} entries, containing wpa_supplicant networks
      #   loosely converted to YAML (see import.py script)
      # - In a (private) flake:
      #   inputs.wirelessNetworks.url = "path:/etc/keys/wireless_networks.json";
      #   inputs.wirelessNetworks.flake = false;
      # - In NixOS config (using flake inputs):
      #   networking.wireless.environmentFile = "/etc/keys/wireless_networks.env";
      #   networking.wireless.networks = builtins.fromJSON (builtins.readFile wirelessNetworks);
    })
  ];
  # wireless support via wpa_supplicant
  networking.wireless = {
    enable = true;
    extraConfig = ''
      country=NL
    '';
    # Public wireless networks
    networks = lib.genAttrs [
      "EurostarTrainsWiFi"
      "_SNCF gare-gratuit"
      "_SNCF_WIFI_INOUI"
      "Wifi in de trein"
      "WiFi in de trein"
      "_WIFI_LYRIA"
      "WIFIonICE"
    ]
      (ssid: { });
    userControlled.enable = true; # Allow some control with wpa_cli
  };
  services.chrony.serverOption = "offline";
}