{ config, pkgs, lib, ... }:

{
  imports = [
    ../../modules
  ];

  networking.domain = "net.clerie.de";

  networking.firewall.logRefusedConnections = lib.mkDefault false;

  time.timeZone = "Europe/Berlin";

  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    keyMap = "de-latin1";
  };

  security.sudo.wheelNeedsPassword = false;

  nix.settings = {
    trusted-users = [ "@wheel" ];
    auto-optimise-store = true;
  };

  environment.systemPackages = with pkgs; [
    gptfdisk
    htop
    parted
    tmux
    colmena
    vim
    agenix
  ];

  programs.mtr.enable = true;

  programs.git.enable = true;

  programs.git.config = {
    user = {
      name = "clerie";
      email = "git@clerie.de";
    };
  };

  services.openssh.enable = true;
  services.openssh.settings = {
    PasswordAuthentication = false;
    KbdInteractiveAuthentication = false;
    PermitRootLogin = lib.mkDefault "no";
  };

  nix.gc = lib.mkDefault {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 30d";
  };

  services.nginx = {
    enableReload = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;

    commonHttpConfig = ''
      server_names_hash_bucket_size 64;
      map $remote_addr $remote_addr_anon {
        ~(?P<ip>\d+\.\d+\.\d+)\.          $ip.0;
        ~(?P<ip>[^:]*:[^:]*(:[^:]*)?):    $ip::;
        default                           ::;
      }
      log_format combined_anon '$remote_addr_anon - $remote_user [$time_local] '
                               '"$request" $status $body_bytes_sent '
                               '"$http_referer" "$http_user_agent"';
      log_format vcombined_anon '$host: $remote_addr_anon - $remote_user [$time_local] '
                                '"$request" $status $body_bytes_sent '
                                '"$http_referer" "$http_user_agent"';
      access_log /var/log/nginx/access.log vcombined_anon;
    '';

    virtualHosts = {
      "default" = {
        default = true;
        rejectSSL = true;
        locations."/" = {
          return = ''200 "Some piece of infrastructure\n"'';
          extraConfig = ''
            types { } default_type "text/plain; charset=utf-8";
          '';
        };
      };
    };
  };
  services.logrotate.settings.nginx = {
    frequency = "daily";
    maxage = 14;
  };

  security.acme = {
    defaults.email = "letsencrypt@clerie.de";
    acceptTerms = true;
  };

  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
    substituters = [
      "https://nix-cache.clerie.de"
    ];
    trusted-public-keys = [
      "nix-cache.clerie.de:bAt1GJTS9BOTcXFWj3nURrSlcjqikCev9yDvqArMP5g="
    ];
  };

  # Pin current nixpkgs channel and flake registry to the nixpkgs version
  # the host got build with
  nix.nixPath = lib.mkForce [ "nixpkgs=${lib.cleanSource pkgs.path}" ];
  nix.registry = {
    "nixpkgs" = {
       from = {
         type = "indirect";
         id = "nixpkgs";
       };
       to = {
         type = "path";
         path = lib.cleanSource pkgs.path;
       };
       exact = true;
    };
  };

  services.fstrim.enable = true;

  clerie.nixfiles.enable = true;

  clerie.backup = {
    targets = {
      cyan.serverName = "cyan.backup.clerie.de";
      magenta.serverName = "magenta.backup.clerie.de";
    };
  };

  nixpkgs.overlays = [
    (import ../../pkgs/overlay.nix)
  ];
}