{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    pia.url = "github:yourusername/pia.nix";
    pia.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { nixpkgs, pia, ... }: {
    nixosConfigurations.yourHost = nixpkgs.lib.nixosSystem {
      modules = [
        pia.nixosModules.default
        # your other modules
      ];
    };
  };
}

{ config, ... }: {
  services.pia = {
    enable = true;
    
    # WARNING: Credentials stored in Nix store - use credentialsFile instead!
    credentials = {
      username = "p1234567";
      password = "yourpassword";
    };
    
    protocol = "wireguard";
    
    autoConnect = {
      enable = true;
      region = "japan";
    };
  };
}

{ config, ... }: {
  # sops-nix configuration
  sops = {
    defaultSopsFile = ./secrets/secrets.yaml;
    age.keyFile = "/var/lib/sops-nix/key.txt";
    
    secrets.pia = {
      # The secret will be available at /run/secrets/pia
      mode = "0400";
    };
  };

  services.pia = {
    enable = true;
    
    # Use the sops secret file
    credentials.credentialsFile = config.sops.secrets.pia.path;
    
    protocol = "wireguard";
    
    autoConnect = {
      enable = true;
      region = "japan";
    };
    
    # Optional settings
    portForwarding.enable = true;
    dns.enable = true;
  };
}

{ config, ... }: {
  age.secrets.pia = {
    file = ./secrets/pia.age;
    mode = "0400";
  };

  services.pia = {
    enable = true;
    credentials.credentialsFile = config.age.secrets.pia.path;
    
    protocol = "wireguard";
    autoConnect = {
      enable = true;
      region = "nl_amsterdam";
    };
  };
}

{ config, ... }: {
  services.pia = {
    enable = true;
    
    # Credentials - use ONE of these methods:
    credentials = {
      # Method 1: Inline (NOT recommended - stored in Nix store)
      username = "p1234567";
      password = "yourpassword";
      
      # Method 2: File (recommended with sops-nix/agenix)
      # File format: line 1 = username, line 2 = password
      credentialsFile = config.sops.secrets.pia.path;
    };
    
    # VPN protocol: "wireguard" (default) or "openvpn"
    protocol = "wireguard";
    
    # Auto-connect on boot
    autoConnect = {
      enable = true;
      region = "japan";  # Run `pia list` to see all regions
    };
    
    # Port forwarding (not available in US regions)
    portForwarding.enable = true;
    
    # Use PIA's DNS servers
    dns.enable = true;
    
    # OpenVPN-specific settings (only used when protocol = "openvpn")
    openvpn = {
      protocol = "udp";      # "udp" or "tcp"
      encryption = "standard"; # "standard" or "strong"
    };
  };
}