{ pkgs, ... }:

{
  programs.throne = {
    enable = true;
    tunMode.enable = true;
  };

  programs.amnezia-vpn.enable = true;

  environment.systemPackages = with pkgs; [
    wireguard-tools
    amneziawg-tools
    amneziawg-go
  ];

  # Throne's sing-box core resolves its underlying DNS by running
  # `resolvectl -i <default-iface> dns` and fails to parse the empty
  # per-link output (enp42s0 has no per-link DNS; ours is global Mullvad
  # in services.resolved). Push the same Mullvad servers per-link so the
  # resolvectl parse succeeds and proxy hostnames can be looked up.
  networking.networkmanager.dispatcherScripts = [
    {
      type = "basic";
      source = pkgs.writeText "link-dns.sh" ''
        #!/bin/sh
        if [ "$1" = "enp42s0" ] && { [ "$2" = "up" ] || [ "$2" = "dhcp4-change" ]; }; then
          ${pkgs.systemd}/bin/resolvectl dns enp42s0 194.242.2.2 194.242.2.4 || true
        fi
      '';
    }
  ];
}