{ lib, config, hypervisorConfig, ... }: {
  options.lab.vm = {
    macAddress = lib.mkOption {
      type = lib.types.str;
      description = ''
        The MAC address of the VM's main NIC.
      '';
    };

    staticNetworking = lib.mkOption {
      default = false;
      type = lib.types.bool;
      description = ''
        Whether this VM has static networking configuration applied.
        Routing is prepopulated, but IP addresses have to be set.
      '';
    };

    staticIPv4 = lib.mkOption {
      type = lib.types.str;
      description = ''
        Static IPv4 address for the VM.
      '';
    };

    staticIPv6 = lib.mkOption {
      type = lib.types.str;
      description = ''
        Static IPv6 address for the VM.
      '';
    };
  };

  config = {
    system.stateVersion = hypervisorConfig.system.stateVersion;

    microvm = {
      shares = [{
        source = "/nix/store";
        mountPoint = "/nix/.ro-store";
        tag = "ro-store";
        proto = "virtiofs";
      }];

      interfaces = [{
        type = "tap";
        id = "vm-${config.networking.hostName}";
        mac = config.lab.vm.macAddress;
      }];
    };

    networking.useDHCP = false;

    systemd.network = {
      enable = true;

      networks = {
        "30-main-nic" = {
          matchConfig.Name = "en*";

          networkConfig = {
            IPv6AcceptRA = ! config.lab.vm.staticNetworking;
            DHCP = lib.mkIf (! config.lab.vm.staticNetworking) "yes";

            Address = lib.mkIf config.lab.vm.staticNetworking [
              "${config.lab.vm.staticIPv4}/${config.lab.networking.dmzIPv4PrefixLength}"
              "${config.lab.vm.staticIPv6}/${config.lab.networking.dmzIPv6PrefixLength}"
            ];

            DNS = lib.mkIf config.lab.vm.staticNetworking [
              config.lab.networking.dmzRouterIPv4
              config.lab.networking.dmzRouterIPv6
            ];
          };

          routes = lib.mkIf config.lab.vm.staticNetworking [
            {
              routeConfig = {
                Gateway = config.lab.networking.dmzRouterIPv4;
                Destination = "0.0.0.0/0";
              };
            }
            {
              routeConfig = {
                Gateway = config.lab.networking.dmzRouterIPv6;
                Destination = "::/0";
              };
            }
          ];
        };
      };
    };
  };
}