# vim: si ai sts=2 sw=2
{
  config,
  lib,
  pkgs,
  ...
}:

let
  lan = "lan0";
  hostName = "r6";
  domain = "home.arpa";
in
{
  imports = [
    ../roles/server.nix
    ../roles/home.nix
  ];
  age.secrets = {
    dyndns.file = ../../secrets/dyndns.age;
    acme.file = ../../secrets/acme.age;
    syncthing.file = ../../secrets/syncthing.age;
  };

  boot.loader.timeout = lib.mkForce 1;
  boot.loader.efi.canTouchEfiVariables = false; # is r/o for some reason
  boot.loader.systemd-boot = {
    installDeviceTree = true;
    edk2-uefi-shell = {
      enable = true;
    };
  };

  srvos.boot.consoles = [ "ttyS2,1500000" ];

  hardware.deviceTree = {
    enable = true;
    name = "rockchip/rk3588s-nanopi-r6c.dtb";
  };

  networking = {
    useDHCP = false;
    inherit domain hostName;
  };

  # TODO find script
  # systemd.services.dynamic-dns-update = {
  #   enable = true;
  #   startAt = [ "hourly" ];
  #   description = "Update IP addresses";
  #   path = with pkgs; [ curl iproute2 dig.dnsutils miller ];
  #   after = [ "sys-subsystem-net-devices-${wan}.device" ];
  #   bindsTo = [ "sys-subsystem-net-devices-${wan}.device" ];
  #   serviceConfig = {
  #     Type = "oneshot";
  #     ExecStart = "/bin/sh /etc/nixos/update-ip ${config.age.secrets.dyndns.path}";
  #   };
  # };
  # services.networkd-dispatcher = {
  #   # broken?
  #   enable = true;
  #   rules = {
  #     update-home-address = {
  #       onState = [ "configured" "configuring" ];
  #       script = ''
  #         #!${pkgs.runtimeShell}
  #         set -eu

  #         if [[ $IFACE == "${wan}" && $OperationalState == "routable" ]]
  #         then
  #           systemctl start dynamic-dns-update.service
  #         fi
  #         exit 0
  #       '';
  #     };
  #     tailscale-subnet-router-optimisation = {
  #       onState = [ "routable" ];
  #       script = ''
  #         #!${pkgs.runtimeShell}
  #         set -eu

  #         if [[ $IFACE == "${wan}" && $OperationalState == "routable" ]]
  #         then
  #           ${pkgs.ethtool}/bin/ethtool -K $IFACE rx-udp-gro-forwarding on rx-gro-list off
  #         fi
  #       '';
  #     };
  #   };
  # };

  environment.systemPackages = with pkgs; [
    file
    tree
    knot-dns
    ethtool
    tcpdump
    conntrack-tools
  ];

  users.mutableUsers = lib.mkForce true;

  users.users.alan = {
    isNormalUser = true;
    openssh.authorizedKeys.keys = [
      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJVREjPey2TOIPzfYJoG9yIR4Rui7tNJK2QIKa+pbgsyXg31hhPIw37LRRIic+l53mW8eahHxX3Y1IeTjcMw8IU= alan@secretive.marvin.local"
    ];
  };

  nix = {
    distributedBuilds = true;
    settings = {
      trusted-public-keys = [
        "mba-1:CxokFjx7YAQWPWMJJKcP50ZpcPUCAFEOrtWdNUMTVjw="
      ];
    };
  };

  users.users.syncthing = {
    isSystemUser = true;
    group = "syncthing";
    homeMode = "0755";
  };
  users.groups.syncthing.members = [ "alan" ];
  services.syncthing = {
    enable = true;
    openDefaultPorts = true;
    dataDir = "/srv/syncthing";
    user = "syncthing";
    group = "syncthing";
    key = config.age.secrets.syncthing.path;
    cert = toString (
      pkgs.writeText "syncthing.crt" ''
        -----BEGIN CERTIFICATE-----
        MIIBmjCCASCgAwIBAgIIUOEmXGFrrX0wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ
        c3luY3RoaW5nMB4XDTIyMDcxMzEwMzIxOVoXDTQ5MTIzMTIzNTk1OVowFDESMBAG
        A1UEAxMJc3luY3RoaW5nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEPiJT41NqucQf
        UXiBwt+yPYnMg9G8oTt9XNA72V99K46D7mIs1F/5oESlDiCSAngXPsajxRY7wyZV
        VoiWegfiaBOGZmq+TyaLlQ5bq/hm/Mp/jVED/rUA+BggohoZZMa2oz8wPTAOBgNV
        HQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1Ud
        EwEB/wQCMAAwCgYIKoZIzj0EAwIDaAAwZQIwLp4Gv5EEmjRO9EphbYJ4jxEJks7E
        oblgnTmhfWmVWmf9avJyeGB212VYu4X8cCKDAjEAn7tTB9Y6LZvYPaLSwUKY3EzF
        hKTYCb7VA/P1dU3tTR1vSQxnu1DsiliD/XcKe2IK
        -----END CERTIFICATE-----
      ''
    );
    overrideFolders = false;
    overrideDevices = false;
    settings = {
      options = {
        maxRecvKbps = 10240;
        maxSendKbps = 1024;
        globalAnnounceEnabled = false;
        relaysEnabled = false;
        natEnabled = false;
        urAccepted = 4;
        trafficClass = 1;
      };
    };
  };

  services.timesyncd.enable = false;
  services.chrony = {
    enable = true;
    extraConfig = ''
      rtcdevice /dev/rtc0
      rtcfile /var/lib/chrony/rtc
      rtcautotrim 30

      allow 10.0.0.0/8
      allow fd12:d04f:65d:42::0/56
    '';
  };

  services.samba = {
    # TODO restore /srv
    enable = false;
    nmbd.enable = false;
    settings = {
      global = {
        "log level" = 1;

        "interfaces" = lan;

        "min protocol" = "SMB2";
        "disable netbios" = true;
        "smb ports" = 445;

        "socket options" = "IPTOS_LOWDELAY TCP_NODELAY SO_KEEPALIVE SO_RCVBUF=65536 SO_SNDBUF=65536";
        "max xmit" = 131072;
        "min receivefile size" = 131072;

        "aio read size" = 1;
        "aio write size" = 1;

        "load printers" = false;
        "disable spoolss" = true;

        "mdns name" = "mdns";

        "follow symlinks" = true;

        "veto files" = "/Thumbs.db/.DS_Store/._.DS_Store/.apdisk/";
        "delete veto files" = true;
      };
      public = {
        path = "/srv/public";
        browseable = "yes";
        "guest ok" = "yes";
        "create mask" = "0666";
        "directory mask" = "0777";
        "read only" = "no";
      };
      Homes = {
        "read only" = "no";
        "valid users" = "%S";
        "inherit acls" = "yes";
      };
      Videos = {
        path = "/srv/videos";
        "valid users" = "alan";
        "create mask" = "0664";
        "directory mask" = "0775";
        "writeable" = "yes";
      };
    };
  };
  services.samba-wsdd = {
    enable = true;
    interface = lan;
  };

  system.stateVersion = "24.11";
}