{ config, lib, pkgs, ... }:

with lib;
let
  hostname = "procul";

  host-ipv4 = "172.86.179.18";
  git-ipv4 = "172.86.179.19";
  domain-name = config.fudo.hosts.${hostname}.domain;
  domain = config.fudo.domains.${domain-name};
  site-name = config.fudo.hosts.${hostname}.site;
  site = config.fudo.sites.${site-name};
  host-fqdn = "${hostname}.${domain-name}";

  local-networks =
    domain.local-networks ++ site.local-networks;

  local-packages = with pkgs; [ ldns.examples ];

  host-secrets = config.fudo.secrets.host-secrets.procul;

  passwd = pkgs.lib.fudo.passwd;

  host-certs = config.fudo.acme.host-domains.${hostname};

  grafana-database-password =
    pkgs.lib.passwd.stablerandom-passwd-file
      "grafana-database-password-${hostname}"
      "grafana-database-password-${hostname}-${config.instance.build-seed}";

in {
  networking = {
    dhcpcd.enable = false;
    useDHCP = false;

    enableIPv6 = true;

    # FIXME: this isn't the right place
    search = [ domain-name ];
    nameservers = [ "127.0.0.1" ];
    defaultGateway = site.gateway-v4;

    interfaces = {
      extif0 = {
        ipv4.addresses = [
          {
            address = host-ipv4;
            prefixLength = 29;
          }
          {
            address = git-ipv4;
            prefixLength = 29;
          }
        ];
      };
    };
  };

  environment.systemPackages = local-packages;

  networking.firewall.allowedTCPPorts = [ 80 443 ];

  security.acme.email = "viator@informis.land";

  users = {
    users = {
      gituser = {
        isSystemUser = true;
        group = "nogroup";
      };
    };
    groups = { acme = { members = [ "nginx" ]; }; };
  };

  informis = {
    cl-gemini = {
      enable = true;

      hostname = "gemini.informis.land";
      server-ip = host-ipv4;
      document-root = "/srv/gemini/root";
      textfiles-archive = "${pkgs.textfiles}";
      slynk-port = 4005;

      feeds = {
        viator = {
          title = "viator's phlog";
          path = "/home/viator/gemini-public/feed/";
          url = "gemini://informis.land/user/viator/feed/";
        };
      };
    };

    # services.chute = let
    #   secret-files = config.fudo.secrets.files.service-secrets.procul;
    # in {
    #   enable = true;
    #   jabber-user = "niten@jabber.fudo.org";
    #   staging = {
    #     secret-file = secret-files."chute-staging.secret";
    #     passphrase-file = secret-files."chute-staging.passphrase";
    #     key-file = secret-files."chute-staging.key";
    #   };
    # };
  };

  fudo = {
    hosts.procul.external-interfaces = [ "extif0" ];

    acme.host-domains.${hostname} = {
      ${host-fqdn} = {
        admin-email = "admin@${domain-name}";
        local-copies = {
          postgresql = {
            user = config.systemd.services.postgresql.serviceConfig.User;
            dependent-services = [ "postgresql.service" ];
            part-of = [ config.fudo.postgresql.systemd-target ];
          };
        };
      };

      # "imap.${domain-name}" = {
      #   admin-email = "admin@${domain-name}";
      #   local-copies.dovecot = {
      #     user = config.services.dovecot2.user;
      #     dependent-services = [ "dovecot2.service" ];
      #   };
      # };

      # "smtp.${domain-name}" = {
      #   admin-email = "admin@${domain-name}";
      #   local-copies.postfix = {
      #     user = config.services.postfix.user;
      #     dependent-services = [ "postfix.service" ];
      #   };
      # };
    };

    secrets.host-secrets.procul = let
      files = config.fudo.secrets.files;
    in {
      # postgres-keytab = {
      #   source-file = files.service-keytabs.procul.postgres;
      #   target-file = "/srv/postgres/secure/postgres.keytab";
      #   user = "root";
      # };

      gitea-database-password = {
        source-file = files.service-passwords.procul.gitea-database;
        target-file = "/srv/gitea/secure/database.passwd";
        user = config.fudo.git.user;
      };

      postgres-gitea-password = {
        source-file = files.service-passwords.procul.gitea-database;
        target-file = "/srv/postgres-users/database.passwd";
        user = config.services.postgresql.superUser;
      };

      heimdal-master-key = {
        source-file = files.realm-master-keys."INFORMIS.LAND";
        target-file = "/run/heimdal/master-key";
        user = config.fudo.auth.kdc.user;
      };

      chute-staging-credentials = {
        source-file = files.service-secrets.procul."chute-staging.env";
        target-file = "/run/chute/staging/credentials.env";
        user = "root";
      };

      grafana-postgres-password = {
        source-file = grafana-database-password;
        target-file = "/run/metrics/grafana/db.passwd";
        user = config.systemd.services.grafana.serviceConfig.User;
      };

      postgres-grafana-password = {
        source-file = grafana-database-password;
        target-file = "/run/postgres-users/grafana.passwd";
        user = config.services.postgresql.superUser;
      };
    };

    client.dns = {
      ipv4 = true;
      ipv6 = true;
      user = "fudo-client";
      external-interface = "extif0";
    };

    secure-dns-proxy = {
      enable = true;
      upstream-dns =
        [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
      bootstrap-dns = "1.1.1.1";
      listen-ips = [ "127.0.0.1" ];
      listen-port = 53;
      allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
    };

    services.mail-server = {
      state-directory = "/srv/mailserver";
    };

    # mail-server = {
    #   enable = true;
    #   debug = true;

    #   domain = domain-name;
    #   mail-hostname = "${host-fqdn}";
    #   monitoring = false;
    #   mail-user = "mailuser";
    #   mail-user-id = 525;
    #   mail-group = "mailgroup";
    #   clamav.enable = true;
    #   dkim.signing = true;

    #   dovecot = let
    #     cert-copy =
    #       host-certs."imap.${domain-name}".local-copies.dovecot;
    #   in {
    #     ssl-certificate = cert-copy.full-certificate;
    #     ssl-private-key = cert-copy.private-key;
    #   };

    #   postfix = let
    #     cert-copy =
    #       host-certs."smtp.${domain-name}".local-copies.postfix;
    #   in {
    #     ssl-certificate = cert-copy.full-certificate;
    #     ssl-private-key = cert-copy.private-key;
    #   };

    #   # This should NOT include the primary domain
    #   local-domains = [ host-fqdn "smtp.${domain-name}" ];

    #   mail-directory = "/srv/mailserver/mail";
    #   state-directory = "/srv/mailserver/state";

    #   trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];

    #   alias-users = {
    #     root = [ "niten" ];
    #     postmaster = [ "niten" ];
    #     hostmaster = [ "niten" ];
    #     webmaster = [ "niten" ];
    #     system = [ "niten" ];
    #     admin = [ "niten" ];
    #     dmarc-report = [ "niten" ];
    #   };
    # };

    services = {
      auth = {
        kerberos = {
          state-directory = "/var/lib/kerberos";
          master-key-file = host-secrets.heimdal-master-key.target-file;
        };
      };
      dns.zones."informis.land" = {
        enable = true;
        default-host = host-ipv4;
      };
      postgresql = {
        state-directory = "/state/services/postgresql";
        keytab = config.fudo.secrets.files.service-keytabs.procul.postgres;
      };
      logging.loki.state-directory = "/state/services/loki";
      metrics = {
        prometheus.state-directory = "/state/services/prometheus";
        grafana = {
          state-directory = "/state/services/grafana";
          database = {
            user = "grafana";
            password-file = host-secrets.grafana-postgres-password.target-file;
          };
        };
      };
    };

    postgresql = let
      # cert-copy = host-certs.${host-fqdn}.local-copies.postgresql;
    in {
      # enable = true;
      # ssl-certificate = cert-copy.full-certificate;
      # ssl-private-key = cert-copy.private-key;
      # keytab = host-secrets.postgres-keytab.target-file;
      # local-networks = local-networks;

      users = {
        grafana = {
          password-file = host-secrets.postgres-grafana-password.target-file;
          databases.grafana = {
            access = "CONNECT";
            entity-access = {
              "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
              # "SELECT,INSERT,UPDATE,DELETE";
              "ALL SEQUENCES IN SCHEMA public" = "ALL PRIVILEGES";
              # "SELECT, UPDATE";
            };
          };
        };

        gituser = {
          password-file =
            host-secrets.postgres-gitea-password.target-file;
          databases = {
            git = {
              access = "CONNECT";
              entity-access = {
                "ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
                "ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
              };
            };
          };
        };
      };

      databases = {
        grafana.users = config.instance.local-admins;
        git.users = config.instance.local-admins;
      };
    };

    git = {
      enable = true;
      hostname = "git.informis.land";
      site-name = "informis git";
      user = "gituser";
      repository-dir = "/srv/git/repo";
      state-dir = "/srv/git/state";
      database = {
        user = "gituser";
        password-file =
          host-secrets.gitea-database-password.target-file;
        hostname = "127.0.0.1";
        name = "git";
      };
      ssh = {
        listen-ip = host-ipv4;
        listen-port = 2222;
      };
    };
  };
}