# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running `nixos-help`).

{
  config,
  lib,
  pkgs,
  ...
}:

with lib;
let
  netif = "eth0";
  hostname = "linde";
  net-ip4 = "116.203.248.56";
  net-mask4 = 32;
  net-gw = "172.31.1.1";
  prefix6 = "2a01:4f8:c012:23a4";
  net-ip6 = "${prefix6}::1";
  net-mask6 = 64;
  net-gw6 = "fe80::1";
  domain = "alin.ovh";
  oldDomain = "alanpearce.eu";
  email = "alan@alanpearce.eu";
  ts-domain = "fin-marlin.ts.net";
in
{
  imports = [
    # Include the results of the hardware scan.
    ./linde-hardware.nix

    ../roles/server.nix
    ../roles/reverse-proxy.nix
    ../roles/auth-dns.nix
    ../roles/binary-cache.nix
    ../roles/forgejo-runner.nix
    ../roles/goatcounter.nix
    ../roles/mailer.nix
    ../roles/readeck.nix
    ../roles/searchix.nix
    ../roles/sso.nix
    ../roles/video-library.nix
    ../settings/services/git-server.nix
  ];
  age.secrets = {
    redis-website.file = ../../secrets/redis-website.age;
    ntfy.file = ../../secrets/ntfy.age;
  };

  boot.loader.efi.efiSysMountPoint = "/boot/efi";

  environment.homeBinInPath = true;
  environment.localBinInPath = true;
  environment.systemPackages = with pkgs; [
    cifs-utils
    lsof
    litecli
    knot-dns

    nixpkgs-review
    nix-output-monitor
  ];

  # Initial empty root password for easy login:
  users.users.root.initialHashedPassword = "";
  programs.ssh.extraConfig = ''
    Host ${domain} git.${domain}
      Hostname git.${domain}
      User gitolite
  '';

  nix = {
    settings = {
      max-jobs = 2;
      trusted-users = [
        "root"
        "nixremote"
      ];
    };
    gc = {
      dates = "08:15";
    };
    optimise = {
      automatic = true;
      dates = [ "02:30" ];
    };
    buildMachines = [
      {
        protocol = "ssh-ng";
        sshUser = "nixremote";
        hostName = "granatum.opia.ovh";
        system = "aarch64-linux";
        maxJobs = 2;
        speedFactor = 1;
        supportedFeatures = [ "kvm" ];
      }
    ];
  };

  networking = {
    hostName = hostname;
    inherit domain;
    dhcpcd.enable = false;
    nameservers = [
      "2606:4700:4700::1111"
      "2606:4700:4700::1001"
      "1.1.1.1"
      "1.0.0.1"
    ];
    hosts = lib.mkForce {
      ${net-ip4} = [
        "${hostname}.${domain}"
        hostname
        "redis"
      ];
      ${net-ip6} = [
        "${hostname}.${domain}"
        hostname
        "redis"
      ];
    };
    defaultGateway = {
      address = net-gw;
      interface = netif;
    };
    defaultGateway6 = {
      address = net-gw6;
      interface = netif;
    };
    interfaces.${netif} = {
      ipv4 = {
        addresses = [
          {
            address = net-ip4;
            prefixLength = net-mask4;
          }
        ];
        routes = [
          {
            address = net-gw;
            prefixLength = 32;
          }
        ];
      };
      ipv6 = {
        addresses = [
          {
            address = net-ip6;
            prefixLength = net-mask6;
          }
        ];
      };
    };
    firewall = {
      allowedTCPPorts = [
        53
        853
        6379
        9418
      ];
      allowedUDPPorts = [
        53
      ];
      trustedInterfaces = [
        "podman0"
      ];
    };
    resolvconf = {
      enable = false;
      useLocalResolver = false;
    };
  };
  services.cloud-init.network.enable = false;
  services.resolved = {
    enable = true;
    settings.Resolve = {
      DNSSEC = true;
    };
  };
  systemd.network.wait-online.enable = lib.mkForce true;

  services.mycal = {
    enable = true;
    port = 8002;

    settings = {
      timezone = config.time.timeZone;
      name = "Alin";
      inherit email;
    };
  };

  zramSwap = {
    enable = true;
    algorithm = "zstd";
  };

  boot.kernel.sysctl =
    let
      buffer_size = 16 * 1024 * 1024;
      server_count = 2;
      max_clients = 100;
      page_size = 4096;
      # This server might have 100 clients simultaneously, so:
      #   max(tcp_wmem) * 2 * 100 / 4096
      mem = toString (buffer_size * server_count * max_clients / page_size);
    in
    {
      "net.ipv4.tcp_allowed_congestion_control" = "bbr illinois reno";
      "net.ipv4.tcp_congestion_control" = "bbr";
      "net.core.default_qdisc" = "fq";

      # Provide adequate buffer memory.
      # rmem_max and wmem_max are TCP max buffer size
      # settable with setsockopt(), in bytes
      # tcp_rmem and tcp_wmem are per socket in bytes.
      # tcp_mem is for all TCP streams, in 4096-byte pages.
      # The following are suggested on IBM's
      # High Performance Computing page
      "net.core.rmem_max" = buffer_size;
      "net.core.wmem_max" = buffer_size;
      "net.core.rmem_default" = buffer_size;
      "net.core.wmem_default" = buffer_size;
      "net.ipv4.tcp_rmem" = "4096 87380 ${toString buffer_size}";
      "net.ipv4.tcp_wmem" = "4096 87380 ${toString buffer_size}";
      "net.ipv4.tcp_mem" = "${mem} ${mem} ${mem}";

      "net.ipv4.tcp_sack" = false;
      "net.ipv4.tcp_dsack" = false;

      "net.ipv4.tcp_slow_start_after_idle" = false;
    };

  security.sudo.extraConfig = ''
    Defaults:root,%wheel env_keep+=EDITOR
  '';

  users.users.root = {
    openssh.authorizedKeys.keys = [
      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHYUyDdw92TNXguAxcmcmZmn/7ECGdRp6ckjxU+5zCw3BCnsS5+xEvHBVnnFdJRoH2XpfMeJjE+fi67zFVhlbn4= root@secretive.marvin"
    ];
  };
  users.users.alin = {
    extraGroups = [
      "wheel"
      "caddy"
      "docker"
      "podman"
      "laminar"
    ];
    isNormalUser = true;
    home = "/home/alin";
    createHome = true;

    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFp1R7ls50vzyCx8pZAwGepQUuos0ogewkIioiW1uMup alin@prefect"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII8VIII+598QOBxi/52O1Kb19RdUdX0aZmS1/dNoyqc5 alan@hetzner.strongbox"
      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBENXbdPPOq0mA+9bPklpUkikvIXjCEKE5IRwNPNMr5/Ta1J/ND737fexCjEb7YPoAJtaf0gD/JThQQi/RxDTvy4= alin@alin.ovh"
    ];
  };

  users.users.nixremote = {
    shell = "/bin/sh";
    isNormalUser = true;
    home = "/var/lib/nixremote/";
    createHome = true;
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPKGzXGgFm/4Da2KNl1wb7TC2YOu/baP/2eFVBaJY0Wq root@marvin"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIy9jFioBvV0JA0lc+De2N+vDOABGHgCECW6vkD33CE4 sourcehut"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIII7sWEwsm8JZiJ0LUnjSt0Kg1RXypG6p5AzP/R2n5ca actions@github.com"
    ];
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It's perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?

  services.powerdns.extraConfig = ''
    local-address=${net-ip4} ${net-ip6}
  '';

  systemd.services.backup-gitolite = {
    startAt = "daily";
    path = with pkgs; [
      openssh
    ];
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${lib.getExe pkgs.rdiff-backup} --api-version 201 backup ${config.services.gitolite.dataDir} ${hostname}@r5.${ts-domain}::gitolite";
      ExecStartPost = "-${lib.getExe pkgs.rdiff-backup} --api-version 201 remove increments --older-than 3M ${hostname}@r5.${ts-domain}::gitolite";
    };
  };

  security.acme = {
    certs."${oldDomain}" = {
      extraDomainNames = [ "*.${oldDomain}" ];
    };
    certs."redis.${domain}" = {
      group = "redis-website";
      reloadServices = [ "redis-website" ];
    };
  };

  services.caddy = {
    virtualHosts =
      let
        inherit (import ../../lib/caddy.nix { inherit lib; }) security-headers;
      in
      {
        "files.${domain}" = {
          extraConfig = ''
            encode zstd gzip
            ${security-headers { }}
            root * /srv/http/files
            file_server browse
          '';
        };
        "cal.${domain}" = {
          extraConfig =
            let
              srv = config.services.mycal;
            in
            ''
              encode zstd gzip
              cache {
                ttl 15m
              }
              reverse_proxy ${srv.host}:${toString srv.port}
            '';
        };
        "go.${domain}" = {
          extraConfig = ''
            encode zstd gzip
            ${security-headers { }}
            root * /srv/http/go.alin.ovh
            file_server
          '';
        };
        "go.${oldDomain}" = {
          extraConfig = ''
            encode zstd gzip
            ${security-headers { }}
            root * /srv/http/go
            file_server
          '';
        };
        "*.${oldDomain}" = {
          useACMEHost = "${oldDomain}";
          extraConfig = ''
            redir https://{labels.2}.${domain}{uri}
          '';
        };
        "ntfy.${domain}" = {
          extraConfig = ''
            reverse_proxy ${config.services.ntfy-sh.settings.listen-http}
          '';
        };
      };
  };
  networking.nat = {
    enable = true;
    internalInterfaces = [ "ve-+" ];
    externalInterface = netif;
    enableIPv6 = true;
  };

  services.redis = {
    servers = {
      website = {
        enable = true;
        port = 0;
        bind = null;
        databases = 1;
        maxclients = 20;
        requirePassFile = config.age.secrets.redis-website.path;
        settings = {
          notify-keyspace-events = "KEA";
          tls-port = 6379;
          tls-cert-file = "/var/lib/acme/redis.${domain}/cert.pem";
          tls-key-file = "/var/lib/acme/redis.${domain}/key.pem";
          tls-ca-cert-file = "/etc/ssl/certs/ca-certificates.crt";
          tls-auth-clients = false;
        };
      };
    };
  };

  services.ntfy-sh = {
    enable = true;
    settings = {
      base-url = "https://ntfy.alin.ovh";
      behind-proxy = true;
      upstream-base-url = "https://ntfy.sh";
      auth-default-access = "deny";
      enable-login = true;
      require-login = true;
    };
    environmentFile = config.age.secrets.ntfy.path;
  };

}