{
  config,
  inputs,
  lib,
  pkgs,
  ...
}:
with lib; let
  bash = "${pkgs.bash}/bin/bash";
  cat = "${pkgs.coreutils}/bin/cat";
  sleep = "${pkgs.coreutils}/bin/sleep";

  create_ap = "${
    config.home-manager.users.${config.custom.username}.services.create_ap.package
  }/bin/create_ap";

  cfg = config.custom.services.create_ap;
in {
  options.custom.services.create_ap = {
    enable = mkOption {default = false;};
    internet = mkOption {default = "eth0";};
    wifi = mkOption {default = "wlan0";};
  };

  config = mkIf cfg.enable {
    age.secrets = let
      secret = filename: {file = "${inputs.self}/secrets/${filename}";};
    in {
      "${config.custom.profile}/create_ap/passphrase" = secret "${config.custom.profile}/create_ap/passphrase";
      "${config.custom.profile}/create_ap/ssid" = secret "${config.custom.profile}/create_ap/ssid";
    };

    # https://github.com/lakinduakash/linux-wifi-hotspot
    services.create_ap = {
      enable = true;

      #!! Declare defaults, enable with interfaces and secrets in machine config
      # https://github.com/lakinduakash/linux-wifi-hotspot/blob/master/src/scripts/create_ap.conf
      settings = {
        COUNTRY = "US";
        FREQ_BAND = 5;
        IEEE80211AC = 1;
        IEEE80211AX = 1;
        IEEE80211N = 1;
        NO_HAVEGED = 1; # Obsolete since kernel v5.6
        NO_VIRT = 1;
      };
    };

    # Override service command with decrypted passphrase
    # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/networking/create_ap.nix
    systemd.services.create_ap.serviceConfig = {
      ExecStartPre = "${sleep} 15s"; # Some cards like Intel force regulatory domain discovery

      ExecStart = let
        configFile = pkgs.writeText "create_ap.conf" (
          generators.toKeyValue {} config.services.create_ap.settings
        );
      in
        mkForce (
          concatStringsSep " " [
            "${bash} -c"
            "'${create_ap}"
            "--config ${configFile}"
            "${cfg.wifi}"
            "${cfg.internet}"
            "$(${cat} ${config.age.secrets."${config.custom.profile}/create_ap/ssid".path})"
            "$(${cat} ${config.age.secrets."${config.custom.profile}/create_ap/passphrase".path})'"
          ]
        );
    };
  };
}