{ config, lib, pkgs, ... }:

with pkgs.lib;
let
  primary-ip = "208.81.3.116";
  hostname = config.instance.hostname;
  host = config.fudo.hosts."${hostname}";
  domainName = host.domain;
  domain = config.fudo.domains."${domainName}";
  site = config.fudo.sites."${host.site}";
  hostFqdn = "${hostname}.${domainName}";
  hostSecrets = config.fudo.secrets.host-secrets."${hostname}";

in {
  config = {
    networking = {
      enableIPv6 = true;
      nameservers = [ "1.1.1.1" ];
      defaultGateway = {
        interface = "extif0";
        address = site.gateway-v4;
      };
      interfaces = {
        extif0 = {
          ipv4.addresses = [{
            address = primary-ip;
            prefixLength = 28;
          }];
        };
      };
    };

    systemd = {
      tmpfiles.rules = [
        "L /etc/adjtime - - - - /state/etc/adjtime"
        "d /state/services 0555 - - - -"
      ];

      services = {
        # This has been failing because NS keys aren't available yet
        "container@nameserver" = {
          after = [ "fudo-secrets.target" ];
          requires = [ "fudo-secrets.target" ];
        };

        fudo-mail-sync = {
          path = with pkgs; [ rsync openssh ];
          serviceConfig = {
            Type = "oneshot";
            ExecStart = pkgs.writeShellScript "fudo-mail-sync.sh" ''
              ssh-add ~/.ssh/id_ed25519
              rsync -avz france.fudo.org:/srv/mail/mailboxes/ /state/services/mail/mail/
              chown 5025:5025 -R /state/services/mail/mail
              chmod go-rwx -R /state/services/mail/mail
            '';
          };
        };
      };

      timers.fudo-mail-sync = {
        wantedBy = [ "timers.target" ];
        timerConfig = {
          OnBootSec = "3h";
          OnUnitActiveSec = "3h";
          Unit = "fudo-mail-sync.service";
        };
      };
    };

    security.acme.defaults.email = "admin@fudo.org";

    virtualisation = {
      podman = {
        enable = true;
        autoPrune.enable = true;
        dockerSocket.enable = true;
        defaultNetwork.settings.dns_enabled = true;
      };
      oci-containers.backend = "podman";
      arion.backend = "podman-socket";
    };

    fudo = {
      client.dns = {
        ipv4 = true;
        ipv6 = true;
        user = "fudo-client";
        external-interface = "extif0";
      };

      mail.state-directory = "/state/services/mail";

      nsd.zones."fudo.org".outgoingInterface = "extif0";

      # Necessary because germany isn't the default yet
      postgresql = {
        enable = true;
        state-directory = "/state/services/postgresql";
      };

      services = {
        auth = {
          kerberos.state-directory = "/state/services/kerberos";
          ldap.state-directory = "/state/services/ldap";
        };
        authoritative-dns.state-directory = "/state/services/dns";
        jabber.state-directory = "/state/services/jabber";
        logging.loki.state-directory = "/state/services/loki";
        metrics = {
          prometheus.state-directory = "/state/services/prometheus";
          grafana.state-directory = "/state/services/grafana";
        };
        postgresql = {
          state-directory = "/state/services/postgresql";
          keytab = extractFudoKeytab {
            realm = domain.gssapi-realm;
            principals = [ "postgres/${hostFqdn}" ];
          };
        };
      };
    };
  };
}