{ config, pkgs, lib, ... }:

{
  imports =
    [
      ./hardware-configuration.nix
    ];

  boot.kernelParams = [ "console=ttyS0,115200n8" ];

  boot.loader.grub.enable = true;
  boot.loader.grub.version = 2;
  boot.loader.grub.device = "/dev/vda";

  boot.loader.grub.extraConfig = ''
    serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
    terminal_input serial
    terminal_output serial
  '';

  networking.hostName = "schule";

  networking.useDHCP = false;
  networking.interfaces.ens18.useDHCP = false;
  networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.37"; prefixLength = 24; } ];
  networking.interfaces.ens19.ipv6.addresses = [ { address = "2001:638:904:ffcb::d"; prefixLength = 64; } ];
  networking.defaultGateway6 = { address = "2001:638:904:ffcb::1"; interface = "ens19"; };
  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; };
  networking.nameservers = [ "141.24.40.3" "141.24.40.4" ];

  users.users.lord.isNormalUser = true;

  users.users.js.isNormalUser = true;

  services.openssh.passwordAuthentication = lib.mkForce true;
  services.openssh.challengeResponseAuthentication = lib.mkForce true;

  services.ttyd = {
    enable = true;
    port = 8436;
    enableIPv6 = true;
    interface = "::1";
  };

  networking.firewall.allowedTCPPorts = [ 80 443 8436 ];

  services.nginx = {
    enable = true;

    virtualHosts = {
      "term.schule.clerie.de" = {
        enableACME = true;
        forceSSL = true;
        locations."/" = {
          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
          proxyPass = "http://[::1]:8436";
          proxyWebsockets = true;
        };
      };

      "term.v6.schule.clerie.de" = {
        enableACME = true;
        forceSSL = true;
        locations."/" = {
          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
          proxyPass = "http://[::1]:8436";
          proxyWebsockets = true;
        };
      };

      "ports.schule.clerie.de" = {
        enableACME = true;
        forceSSL = true;
        locations."/" = {
          return = ''200 "Some piece of infrastructure\n"'';
          extraConfig = ''
            types { } default_type "text/plain; charset=utf-8";
          '';
        };
      };

      "\"~^(?<requestedport>[0-9]{4,5})\.ports\.schule\.clerie\.de$\"" = {
        forceSSL = true;
        sslCertificate = "${config.security.acme.certs."ports.schule.clerie.de".directory}/fullchain.pem";
        sslCertificateKey = "${config.security.acme.certs."ports.schule.clerie.de".directory}/key.pem";
        locations."/" = {
          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
          proxyPass = "http://127.0.0.1:$requestedport";
          proxyWebsockets = true;
        };
      };

      "ports.v6.schule.clerie.de" = {
        enableACME = true;
        forceSSL = true;
        locations."/" = {
          return = ''200 "Some piece of infrastructure\n"'';
          extraConfig = ''
            types { } default_type "text/plain; charset=utf-8";
          '';
        };
      };

      "\"~^(?<requestedport>[0-9]{4,5})\.ports\.v6\.schule\.clerie\.de$\"" = {
        forceSSL = true;
        sslCertificate = "${config.security.acme.certs."ports.v6.schule.clerie.de".directory}/fullchain.pem";
        sslCertificateKey = "${config.security.acme.certs."ports.v6.schule.clerie.de".directory}/key.pem";
        locations."/" = {
          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
          proxyPass = "http://127.0.0.1:$requestedport";
          proxyWebsockets = true;
        };
      };
    };
  };

  services.mysql = {
    enable = true;
    package = pkgs.mariadb;
  };

  system.stateVersion = "22.11";
}