age.secrets."ppp-credentials".file = ../../agenix/ppp-credentials.age;

  services.pppd = {
    enable = true;
    peers."1und1" = {
      config = ''
        debug
        plugin pppoe.so
        nic-enp1s0
        file ${config.age.secrets."ppp-credentials".path}
        mtu 1500
        mru 1500
        maxfail 0
        novj
        +ipv6
        noauth
        defaultroute
        persist
        noaccomp
        default-asyncmap
        lcp-echo-interval 30
        lcp-echo-failure 4
        #lcp-echo-adaptive
        lcp-max-configure 10
      '';
    };
  };

I discovered this gem:

root@OpenWrt:~# cat /etc/ppp/filter
#
# Expression: outbound and not icmp[0] != 8 and not tcp[13] & 4 != 0
#
19
48 0 0 0
21 0 16 1
40 0 0 2
21 0 13 33
48 0 0 13
21 0 5 1
40 0 0 10
69 9 0 8191
177 0 0 4
80 0 0 4
21 6 7 8
21 0 5 6
40 0 0 10
69 3 0 8191
177 0 0 4
80 0 0 17
69 1 0 4
6 0 0 4
6 0 0 0

          environment = {
            # pppd likes to write directly into /var/run. This is rude
            # on a modern system, so we use libredirect to transparently
            # move those files into /run/pppd.
            LD_PRELOAD = "${pkgs.libredirect}/lib/libredirect.so";
            NIX_REDIRECTS = "/var/run=/run/pppd";
          };