diff --git a/examples/rotuer.nix b/examples/rotuer.nix
index 3dc564b..5bb0777 100644
--- a/examples/rotuer.nix
+++ b/examples/rotuer.nix
@@ -37,14 +37,10 @@ in rec {
     ../modules/dnsmasq
     ../modules/firewall
     ../modules/hostapd
+    ../modules/bridge
   ];
   rootfsType = "jffs2";
   hostname = "rotuer";
-  kernel = {
-    config = {
-      BRIDGE = "y";
-    };
-  };
 
   services.hostap = svc.hostapd {
     interface = config.hardware.networkInterfaces.wlan_24;
@@ -87,29 +83,19 @@ in rec {
   };
 
   services.int =
-    let iface = interface {
-          type = "bridge";
-          device = "int";
+    let iface = svc.bridge.primary {
+          ifname = "int";
         };
     in address iface {
       family = "inet4"; address ="10.8.0.1"; prefixLength = 16;
     };
 
-  services.bridge =
-    let
-      primary = services.int;
-      addif = dev: oneshot {
-        name = "add-${dev.device}-to-bridge";
-        up = "${ifwait}/bin/ifwait -v ${dev.device} running && ip link set dev ${dev.device} master ${primary.device}";
-        down = "ip link set dev ${dev} nomaster";
-        dependencies = [ primary dev ];
-      };
-    in bundle {
-      name = "bridge-members";
-      contents = with config.hardware.networkInterfaces; map addif [
-        wlan_24 lan wlan_5
-      ];
-    };
+  services.bridge = svc.bridge.members {
+    primary = services.int;
+    members = with config.hardware.networkInterfaces;  [
+      wlan_24 lan wlan_5
+    ];
+  };
 
   services.ntp =
     let config = writeText "chrony.conf" ''
diff --git a/modules/bridge/default.nix b/modules/bridge/default.nix
new file mode 100644
index 0000000..27329cd
--- /dev/null
+++ b/modules/bridge/default.nix
@@ -0,0 +1,22 @@
+{ lib, pkgs, config, ...}:
+let
+  inherit (lib) mkOption types;
+  inherit (pkgs.liminix.services) oneshot;
+in
+{
+  options = {
+    system.service.bridge = {
+      primary = mkOption {
+        type = types.functionTo pkgs.liminix.lib.types.service;
+      };
+      members = mkOption {
+        type = types.functionTo pkgs.liminix.lib.types.service;
+      };
+    };
+  };
+  config = {
+    system.service.bridge.primary = pkgs.callPackage ./primary.nix {};
+    system.service.bridge.members = pkgs.callPackage ./members.nix {};
+    kernel.config.BRIDGE = "y";
+  };
+}
diff --git a/modules/bridge/members.nix b/modules/bridge/members.nix
new file mode 100644
index 0000000..537877d
--- /dev/null
+++ b/modules/bridge/members.nix
@@ -0,0 +1,35 @@
+{
+  liminix
+, ifwait
+, lib
+}:
+let
+  inherit (liminix.networking) interface;
+  inherit (liminix.services) bundle oneshot;
+  inherit (liminix.lib) typeChecked;
+  inherit (lib) mkOption types;
+  t = {
+    members = mkOption {
+      type = types.listOf liminix.lib.types.service;
+      description = "interfaces to add to the bridge";
+    };
+    primary = mkOption {
+      type = liminix.lib.types.service;
+      description = "bridge interface to add them to";
+    };
+  };
+in
+params:
+let
+  inherit (typeChecked "bridge-members" t params) members primary;
+  addif = member :
+    oneshot {
+      name = "add-${member.device}-to-br-${primary.device}";
+      up = "${ifwait}/bin/ifwait ${member.device} running && ip link set dev ${member.device} master ${primary.device}";
+      down = "ip link set dev ${member.device} nomaster";
+      dependencies = [ primary member ];
+    };
+in bundle {
+  name = "bridge-${primary.device}-members";
+  contents = map addif members;
+}
diff --git a/modules/bridge/primary.nix b/modules/bridge/primary.nix
new file mode 100644
index 0000000..11ced24
--- /dev/null
+++ b/modules/bridge/primary.nix
@@ -0,0 +1,22 @@
+{
+  liminix
+, lib
+}:
+let
+  inherit (liminix.networking) interface;
+  inherit (liminix.lib) typeChecked;
+  inherit (lib) mkOption types;
+  t = {
+    ifname = mkOption {
+      type = types.str;
+      description = "interface name for the bridge device";
+    };
+  };
+in
+params:
+let
+  inherit (typeChecked "bridge" t params) ifname;
+in interface {
+  device = ifname;
+  type = "bridge";
+}