# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running `nixos-help`).

{
  lib,
  pkgs,
  ...
}:

with lib;
let
  netif = "eth0";
  hostname = "linde";
  net-ip4 = "116.203.248.56";
  net-mask4 = 32;
  net-gw = "172.31.1.1";
  prefix6 = "2a01:4f8:c012:23a4";
  net-ip6 = "${prefix6}::1";
  net-mask6 = 64;
  net-gw6 = "fe80::1";
  domain = "alin.ovh";
in
{
  imports = [
    # Include the results of the hardware scan.
    ./linde-hardware.nix

    ../roles/remote.nix
    ../roles/server.nix
    ../roles/reverse-proxy.nix
    ../roles/forgejo-runner.nix
    ../roles/mailer.nix
    ../roles/nix-remote-builder.nix
    ../roles/paperless.nix
    ../roles/push-notifications.nix
    ../roles/readeck.nix
    ../roles/redis-website.nix
    ../roles/searchix.nix
    ../roles/sso.nix
    ../roles/subdomain-redirector.nix
    ../roles/video-library.nix
  ];

  boot.loader.efi.efiSysMountPoint = "/boot/efi";

  environment.systemPackages = with pkgs; [
    cifs-utils
    knot-dns
  ];

  # Initial empty root password for easy login:
  users.users.root.initialHashedPassword = "";
  programs.ssh.extraConfig = ''
    Host ${domain} git.${domain}
      Hostname git.${domain}
      User gitolite
  '';

  nix = {
    settings = {
      max-jobs = 2;
    };

    buildMachines = [
      {
        protocol = "ssh-ng";
        sshUser = "nixremote";
        hostName = "granatum.opia.ovh";
        system = "aarch64-linux";
        maxJobs = 2;
        speedFactor = 1;
        supportedFeatures = [ "kvm" ];
      }
    ];
  };

  networking = {
    hostName = hostname;
    dhcpcd.enable = false;
    nameservers = [
      "2606:4700:4700::1111"
      "2606:4700:4700::1001"
      "1.1.1.1"
      "1.0.0.1"
    ];
    hosts = lib.mkForce {
      ${net-ip4} = [
        "${hostname}.${domain}"
        hostname
      ];
      ${net-ip6} = [
        "${hostname}.${domain}"
        hostname
      ];
    };
    defaultGateway = {
      address = net-gw;
      interface = netif;
    };
    defaultGateway6 = {
      address = net-gw6;
      interface = netif;
    };
    interfaces.${netif} = {
      ipv4 = {
        addresses = [
          {
            address = net-ip4;
            prefixLength = net-mask4;
          }
        ];
        routes = [
          {
            address = net-gw;
            prefixLength = 32;
          }
        ];
      };
      ipv6 = {
        addresses = [
          {
            address = net-ip6;
            prefixLength = net-mask6;
          }
        ];
      };
    };
    resolvconf = {
      enable = false;
      useLocalResolver = false;
    };
  };
  services.cloud-init.network.enable = false;
  services.resolved = {
    enable = true;
    settings.Resolve = {
      DNSSEC = true;
    };
  };
  systemd.network.wait-online.enable = lib.mkForce true;

  zramSwap = {
    enable = true;
    algorithm = "zstd";
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It's perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?
}