{ config, lib, pkgs, ... }:

let
  primary-ip = "10.0.0.1";
  dns-proxy-ip = "10.0.0.2";

in {
  fudo.local-network = {
    # FIXME: think about this -- actual network config?
    enable = true;
    # NOTE: requests go:
    #  - local bind instance
    #  - pi-hole
    #  - DoH resolver
    dns-servers = [ primary-ip ];
    gateway = primary-ip;
    dhcp-interfaces = [ "intif0" ];
    dns-serve-ips = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
    recursive-resolver = "${primary-ip} port 5353";
    server-ip = primary-ip;
    domain = "rus.selby.ca";
  };

  networking = {
    firewall = {
      enable = true;
      trustedInterfaces = [ "intif0" "docker0" ];
      allowedTCPPorts = [ 22 ];
    };

    interfaces = {
      enp2s0.useDHCP = false;
      enp3s0.useDHCP = false;
      enp4s0.useDHCP = false;

      enp1s0.useDHCP = true;

      intif0 = {
        useDHCP = false;
        ipv4.addresses = [
          {
            address = primary-ip;
            prefixLength = 22;
          }
          {
            address = dns-proxy-ip;
            prefixLength = 32;
          }
        ];
      };

      extif0 = { useDHCP = true; };
    };

    nat = {
      enable = true;
      externalInterface = "extif0";
      internalInterfaces = [ "intif0" ];
    };
  };

  fudo = {
    garbage-collector = {
      enable = true;
      timing = "weekly";
    };

    secure-dns-proxy = {
      enable = true;
      listen-port = 53;
      upstream-dns =
        [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
      bootstrap-dns = "1.1.1.1";
      listen-ips = [ dns-proxy-ip ];
    };
  };

  # environment.systemPackages = with pkgs; [ dnsproxy ];

  virtualization = {
    docker = {
      enable = true;
      autoPrune.enable = true;
      enableOnBoot = true;
    };
  };

  docker-containers = {
    pihole = {
      image = "pihole/pihole:v5.1.2";
      ports = [ "5353:53/tcp" "5353:53/udp" "3080:80/tcp" ];
      environment = {
        ServerIP = primary-ip;
        VIRTUAL_HOST = "dns-hole.rus.selby.ca";
        DNS1 = dns-proxy-ip;
      };
      volumes = [
        "/srv/pihole/etc-pihole/:/etc/pihole/"
        "/srv/pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/"
      ];
    };
  };

  services.nginx = {
    enable = true;

    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedProxySettings = true;

    virtualHosts = {
      "dns-hole.rus.selby.ca" = {
        serverAliases = [
          "pihole.rus.selby.ca"
          "hole.rus.selby.ca"
          "pihole"
          "dns-hole"
          "hole"
        ];

        locations."/" = {
          proxyPass = "http://127.0.0.1:3080";

          # extraConfig = ''
          #   proxy_set_header Host $host;
          #   proxy_set_header X-Real-IP $remote_addr;
          #   proxy_set_header X-Forwarded-By $server_addr:$server_port;
          #   proxy_set_header X-Forwarded-For $remote_addr;
          #   proxy_set_header X-Forwarded-Proto $scheme;
          # '';
        };
      };
    };
  };
}