{ config, lib, ... }:
{
  # WiFi configuration for NixOS hosts
  # Import this module on hosts that should connect to WiFi
  # Credentials stored in secrets/wifi.yaml (access controlled via .sops.yaml)

  sops.secrets.wifi-password-pi = {
    sopsFile = ./../secrets/wifi.yaml;
  };

  networking.wireless = {
    enable = true;
    networks = {
      "pi" = {
        pskRaw = "ext:wifi-password-pi";
      };
    };
    # Only enable on wireless interface, not ethernet
    interfaces = [ "wlan0" ];
  };

  # Prefer wifi over ethernet, but keep ethernet as fallback
  networking.dhcpcd.extraConfig = ''
    # Prefer wlan0 over ethernet interfaces
    interface wlan0
    metric 100

    interface eth0
    metric 200
  '';

  # Persist wireless configuration across reboots (for impermanence)
  environment.persistence.${config.custom.impermanence.persistPath} = {
    files = [
      "/etc/wpa_supplicant.conf"
    ];
  };
}