{ config, pkgs, lib, ... }:

{
  imports =
    [
      ./hardware-configuration.nix
    ];

  profiles.clerie.netcup.enable = true;
  profiles.clerie.router.enable = true;

  boot.loader.grub.enable = true;
  boot.loader.grub.device = "/dev/sda";

  systemd.network.networks."10-wan" = {
    matchConfig.Name = "ens3";
    address = [
      "2a03:4000:6:48d::1/64"
      "5.45.100.191/22"
    ];
    routes = [
      { Gateway = "fe80::1"; }
      { Gateway = "5.45.100.1"; }
    ];
    linkConfig.RequiredForOnline = "routable";
    ipv6AcceptRAConfig.DHCPv6Client = "no";
  };

  profiles.clerie.common-webserver.httpDefaultVirtualHost = false;

  services.unbound = {
    enable = true;
    resolveLocalQueries = false;
    settings = {
      server = {
        interface = [ "127.0.0.1" ];
      };
    };
  };

  clerie.nginx-port-forward = {
    enable = true;
    resolver = "127.0.0.1";
    tcpPorts."80" = {
      host = "baikonur.dyn.weimarnetz.de";
      port = 80;
    };
    tcpPorts."443" = {
      host = "baikonur.dyn.weimarnetz.de";
      port = 443;
    };
    tcpPorts."2022" = {
      host = "nonat.net.clerie.de";
      port = 22;
    };
  };

  networking.firewall.allowedTCPPorts = [ 80 443 ];
  networking.firewall.allowedUDPPorts = [];

  services.bijwerken = {
    autoUpgrade = true;
  };

  clerie.monitoring = {
    enable = true;
    id = "102";
    pubkey = "+mJN+ustPo2ehP0wqajYs3nTdJ0SPuIDyiZQSHFIK3o=";
    blackbox = true;
  };

  system.stateVersion = "21.03";
}