{ pkgs, ... }:

{
  services.openssh.enable = true;

  services.mihomo = {
    enable = true;
    tunMode = true;
    configFile = "/etc/mihomo-config.yaml";
  };

  systemd.services.mihomo = {
    after = [ "ssh-direct-route.service" ];
    requires = [ "ssh-direct-route.service" ];
  };

  # Keep SSH replies outside the transparent proxy before Mihomo starts.
  systemd.services.ssh-direct-route = {
    description = "Keep SSH replies on the unmodified main routing table";
    wantedBy = [ "multi-user.target" ];
    before = [ "mihomo.service" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStart = "${pkgs.iproute2}/bin/ip rule add pref 8000 ipproto tcp sport 22 lookup main";
      ExecStop = "${pkgs.iproute2}/bin/ip rule del pref 8000 ipproto tcp sport 22 lookup main";
    };
  };
}