{ config, lib, pkgs, ... }:

let
  primary-ip = "10.0.0.1";
  dns-proxy-ip = "10.0.0.5";

in {
  fudo.local-network = let
    hostname = config.instance.hostname;
    site-name = config.fudo.hosts.${hostname}.site;
    site = config.fudo.site.${site-name};

  in {
    enable = true;
    dns-servers = site.dns-servers;
    gateway = site.gateway;
    dhcp-interfaces = [ "intif0" ];
    dns-serve-ips = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
    recursive-resolver = "${primary-ip} port 5353";
    server-ip = primary-ip;
  };

  fudo.slynk.enable = true;

  # systemd.network.networks.eno2 = {
  #   extraConfig = {
  #     IPv6AcceptRA = true;
  #     IPv6PrefixDelegation = "dhcpv6";
  #   };
  # };

  networking = {
    # dhcpd.extraConfig = ''
    #   interface eno2
    #     ia_na 1
    #     ia_pd 2 eno2/0
    # '';

    eno1.useDHCP = false;
    eno2.useDHCP = false;
    eno3.useDHCP = false;
    eno4.useDHCP = false;
    enp33s0f0.useDHCP = false;
    enp33s0f1.useDHCP = false;
    enp9s0f0.useDHCP = false;
    enp9s0f1.useDHCP = false;

    intif0 = {
      useDHCP = false;
      ipv4.addresses = [
        {
          address = primary-ip;
          prefixLength = 22;
        }
        {
          address = dns-proxy-ip;
          prefixLength = 32;
        }
      ];
    };

    extif0 = { useDHCP = true; };

    nat = {
      enable = true;
      externalInterface = "extif0";
      internalInterfaces = [ "intif0" ];
    };
  };

  fudo = {
    client.dns = {
      enable = true;
      ipv4 = true;
      ipv6 = true;
      user = "fudo-client";
      external-interface = "extif0";
      password-file = "/srv/client/secure/client.passwd";
    };

    secure-dns-proxy = {
      enable = true;
      port = 3535;
      upstream-dns =
        [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
      bootstrap-dns = "1.1.1.1";
      listen-ips = [ dns-proxy-ip ];
    };
  };

  virtualization = {
    docker = {
      enable = true;
      autoPrune.enable = true;
      enableOnBoot = true;
    };

    libvirtd = {
      enable = true;
      qemuPackage = pkgs.qemu_kvm;
      onShutdown = "shutdown";
    };
  };

  docker-containers = {
    pihole = {
      image = "pihole/pihole:4.3.2-1";
      ports = [ "5353:53/tcp" "5353:53/udp" "3080:80/tcp" ];
      environment = {
        ServerIP = primary-ip;
        VIRTUAL_HOST = "dns-hole.sea.fudo.org";
        DNS1 = dns-proxy-ip;
      };
      volumes = [
        "/srv/pihole/etc-pihole/:/etc/pihole/"
        "/srv/pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/"
      ];
    };
  };

  security.acme.certs = {
    "sea-camera.fudo.link".email = "niten@fudo.org";
    "sea-camera-od.fudo.link".email = "niten@fudo.org";
  };

  services = {
    nginx = {
      enable = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedTlsSettings = true;
      recommendedProxySettings = true;

      virtualHosts = {
        "sea-camera.fudo.link" = {
          enableACME = true;
          forceSSL = true;
          locations."/" = {
            proxyPass = "http://panopticon.sea.fudo.org/";
            extraConfig = ''
              proxy_http_version 1.1;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection "Upgrade";
            '';
          };
        };

        # Supposed to be for object detection...
        "sea-camera-od.fudo.link" = {
          enableACME = true;
          forceSSL = true;
          locations."/" = {
            proxyPass = "http://panopticon-od.sea.fudo.org/";
            extraConfig = ''
              proxy_http_version 1.1;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection "Upgrade";
            '';
          };
        };

        "pihole.sea.fudo.org" = {
          serverAliases = [ "dns-hole.sea.fudo.org" "hole.sea.fudo.org" ];
          locations."/" = { proxyPass = "http://127.0.0.1:3000"; };
        };
      };
    };
  };
}