{ config, lib, pkgs, ... }:

let
  primary-ip = "208.81.3.116";
  hostname = config.instance.hostname;
  host = config.fudo.hosts."${hostname}";
  domainName = host.domain;
  site = config.fudo.sites."${host.site}";
  hostFqdn = "${hostname}.${domainName}";
  hostSecrets = config.fudo.secrets.host-secrets."${hostname}";
in {
  config = {
    networking = {
      enableIPv6 = true;
      nameservers = [ "1.1.1.1" ];
      defaultGateway = {
        interface = "extif0";
        address = site.gateway-v4;
      };
      interfaces.extif0 = {
        ipv4.addresses = [{
          address = primary-ip;
          prefixLength = 28;
        }];
      };
      firewall = {
        enable = false;
        interfaces.podman0.allowedUDPPorts = [ 53 ];
      };
    };

    systemd.tmpfiles.rules = [
      "L /etc/adjtime - - - - /state/etc/adjtime"
      "d /state/services 0555 - - - -"
    ];

    security.acme.defaults.email = "admin@fudo.org";

    virtualisation = {
      podman = {
        enable = true;
        autoPrune.enable = true;
        dockerSocket.enable = true;
        defaultNetwork.settings.dns_enabled = true;
      };
      oci-containers.backend = "podman";
      arion.backend = "podman-socket";
    };

    fudo = {
      client.dns = {
        ipv4 = true;
        ipv6 = true;
        user = "fudo-client";
        external-interface = "extif0";
      };

      mail.state-directory = "/state/services/mail";

      nsd.zones."fudo.org".outgoingInterface = "extif0";

      services = {
        auth = {
          kerberos.state-directory = "/state/services/kerberos";
          ldap.state-directory = "/state/services/ldap";
        };
        authoritative-dns.state-directory = "/state/services/dns";
        jabber.state-directory = "/state/services/jabber";
      };
    };
  };
}