{ lib, ... }:

with lib;
rec {
  masterKeyOpts = { ... }: {
    options = with types; {
      key-path = mkOption {
        type = str;
        description = "Path of the host master key file, used to decrypt secrets.";
      };

      public-key = mkOption {
        type = str;
        description = "Public key used during deployment to decrypt secrets for the host.";
      };
    };
  };

  hostOpts = { hostname, ... }: {
    options = with types; {
      master-key = mkOption {
        type = nullOr (submodule masterKeyOpts);
        description = "Public key for the host master key, used by the host to decrypt secrets.";
        default = null;
      };

      domain = mkOption {
        type = str;
        description =
          "Primary domain to which the host belongs, in the form of a domain name.";
        default = "fudo.org";
      };

      extra-domains = mkOption {
        type = listOf str;
        description = "Extra domain in which this host is reachable.";
        default = [ ];
      };

      aliases = mkOption {
        type = listOf str;
        description =
          "Host aliases used by the current host. Note this will be multiplied with extra-domains.";
        default = [ ];
      };

      site = mkOption {
        type = str;
        description = "Site at which the host is located.";
        default = "unsited";
      };

      local-networks = mkOption {
        type = listOf str;
        description =
          "A list of networks to be considered trusted by this host.";
        default = [ "127.0.0.0/8" ];
      };

      profile = mkOption {
        type = listOf (enum ["desktop" "server" "laptop"]);
        description =
          "The profile to be applied to the host, determining what software is included.";
      };

      admin-email = mkOption {
        type = nullOr str;
        description = "Email for the administrator of this host.";
        default = null;
      };

      local-users = mkOption {
        type = listOf str;
        description =
          "List of users who should have local (i.e. login) access to the host.";
        default = [ ];
      };

      description = mkOption {
        type = str;
        description = "Description of this host.";
        default = "Another Fudo Host.";
      };

      local-admins = mkOption {
        type = listOf str;
        description =
          "A list of users who should have admin access to this host.";
        default = [ ];
      };

      local-groups = mkOption {
        type = listOf str;
        description = "List of groups which should exist on this host.";
        default = [ ];
      };

      ssh-fingerprints = mkOption {
        type = listOf str;
        description = ''
          A list of DNS SSHFP records for this host. Get with `ssh-keygen -r <hostname>`
        '';
        default = [ ];
      };

      rp = mkOption {
        type = nullOr str;
        description = "Responsible person.";
        default = null;
      };

      tmp-on-tmpfs = mkOption {
        type = bool;
        description =
          "Use tmpfs for /tmp. Great if you've got enough (>16G) RAM.";
        default = true;
      };

      enable-gui = mkEnableOption "Install desktop GUI software.";

      docker-server = mkEnableOption "Enable Docker on the current host.";

      kerberos-services = mkOption {
        type = listOf str;
        description =
          "List of services which should exist for this host, if it belongs to a realm.";
        default = [ "ssh" "host" ];
      };

      ssh-pubkeys = mkOption {
        type = listOf path;
        description =
          "SSH key files of the host.";
        default = [];
      };

      build-pubkeys = mkOption {
        type = listOf str;
        description = "SSH public keys used to access the build server.";
        default = [ ];
      };

      external-interfaces = mkOption {
        type = listOf str;
        description = "A list of interfaces on which to enable the firewall.";
        default = [ ];
      };

      keytab-secret-file = mkOption {
        type = nullOr str;
        description = "Keytab from which to create a keytab secret.";
        default = null;
      };

      keep-cool = mkOption {
        type = bool;
        description = "A host that tends to overheat. Try to keep it cooler.";
        default = false;
      };

      nixos-system = mkOption {
        type = bool;
        description = "Whether the host is a NixOS system.";
        default = true;
      };

      arch = mkOption {
        type = str;
        description = "System architecture of the system.";
      };

      machine-id = mkOption {
        type = nullOr str;
        description = "Machine id of the system. See: man machine-id.";
        default = null;
      };

      android-dev = mkEnableOption "Enable ADB on the host.";

      # FIXME: This probably belongs elsewhere...
      initrd-ip = mkOption {
        type = nullOr str;
        description = "IP to assign to the kernel/initrd, to allow access when boot fails.";
        default = null;
      };

      initrd-ssh-keypair = let
        keypair = { ... }: {
          options = {
            public-key = mkOption {
              type = str;
              description = "SSH public key.";
            };

            private-key = mkOption {
              type = str;
              description = "SSH private key.";
            };

            type = mkOption {
              type = enum [ "rsa" "ecdsa" "ed25519" ];
              description = "SSH key type.";
            };
          };
        };
      in mkOption {
        type = nullOr (submodule keypair);
        description = "SSH Keypair to use for initrd.";
        default = null;
      };
    };
  };
}