{
  config,
  lib,
  pkgs,
  ...
}:
let
  hostName = "r5";
  domain = "home.arpa";
  tailnet = "fin-marlin.ts.net";
in
{
  imports = [
    ../roles/server.nix
  ];
  age.secrets = {
    acme.file = ../../secrets/acme.age;
    syncthing.file = ../../secrets/syncthing.age;
  };

  networking = {
    useDHCP = true;
    inherit domain hostName;
    hosts = {
      "fd7a:115c:a1e0::53" = [
        "tailscale"
        "ts"
      ];
      "192.168.100.1" = [
        "modem"
        "pyur"
      ];
    };
    nameservers = [
      "9.9.9.11"
      "149.112.112.11"
      "2620:fe::11"
      "2620:fe::fe:11"
    ];
    nftables.enable = true;
  };
  systemd.network = {
    enable = true;
  };
  services.resolved = {
    enable = true;
    settings.Resolve = {
      DNS = [ ];
      LLMNR = false;
      MulticastDNS = true;
    };
  };

  services.openssh.openFirewall = true;

  services.tailscale = {
    enable = true;
  };

  environment.systemPackages = with pkgs; [
    file
    tree
    lsof
    knot-dns
  ];

  programs.fish = {
    enable = true;
    package = pkgs.fishMinimal;
  };
  users.defaultUserShell = config.programs.fish.package;

  users.users.alin = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    openssh.authorizedKeys.keys = [
      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBENXbdPPOq0mA+9bPklpUkikvIXjCEKE5IRwNPNMr5/Ta1J/ND737fexCjEb7YPoAJtaf0gD/JThQQi/RxDTvy4= alin@secretive.marvin.local"
    ];
  };

  users.users.root = {
    openssh.authorizedKeys.keys = [
      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHYUyDdw92TNXguAxcmcmZmn/7ECGdRp6ckjxU+5zCw3BCnsS5+xEvHBVnnFdJRoH2XpfMeJjE+fi67zFVhlbn4= root@secretive.marvin.local"
    ];
  };

  services.caddy = {
    enable = true;
    globalConfig = ''
      pki {
        ca home {
          name "Home CA"
        }
      }
    '';
    virtualHosts = {
      "${hostName}.${domain}" = {
        serverAliases = [ "${hostName}.${tailnet}" ];
        extraConfig = ''
          tls {
            issuer internal {
              ca home
            }
          }
          root /var/lib/caddy/ca
          file_server browse
        '';
      };
      "ca.${domain}" = {
        extraConfig = ''
          tls {
            issuer internal {
              ca home
            }
          }
          acme_server {
            allow {
              domains *.test *.${domain}
            }
          }
        '';
      };
    };
  };

  nix = {
    settings = {
      max-jobs = 2;
      builders-use-substitutes = true;
    };
  };

  system.autoUpgrade = {
    enable = lib.mkForce false;
    dates = "04:15";
    randomizedDelaySec = "59 min";
    flake = "git+https://git.alin.ovh/nixfiles";
    allowReboot = true;
    rebootWindow = {
      lower = "01:00";
      upper = "06:00";
    };
  };

  services.timesyncd.enable = false;
  services.chrony = {
    enable = true;
    extraConfig = ''
      rtcdevice /dev/rtc0
      rtcfile /var/lib/chrony/rtc
      rtcautotrim 30

      allow 10.0.0.0/8
      allow fd12:d04f:65d:42::0/56
    '';
  };

  system.stateVersion = "25.11";
}