{ config, pkgs, lib, ... }:

{
  imports =
    [
      ./hardware-configuration.nix

      ./documentation.nix
    ];

  profiles.clerie.mercury-vm.enable = true;

  boot.loader.grub.enable = true;
  boot.loader.grub.device = "/dev/vda";

  systemd.network.networks."10-wan" = {
    matchConfig.Name = "ens20";
    address = [
      "2001:638:904:ffc9::7/64"
    ];
    routes = [
      { Gateway = "2001:638:904:ffc9::1"; }
    ];
    linkConfig.RequiredForOnline = "routable";
    ipv6AcceptRAConfig.DHCPv6Client = "no";
  };
  systemd.network.networks."10-nat-netz-mercury" = {
    matchConfig.Name = "ens18";
    address = [
      "192.168.10.23/24"
    ];
    routes = [
      { Gateway = "192.168.10.1"; }
    ];
    linkConfig.RequiredForOnline = "routable";
    ipv6AcceptRAConfig.DHCPv6Client = "no";
  };
  systemd.network.networks."10-dn42-ospf-netz" = {
    matchConfig.Name = "ens19";
    linkConfig.RequiredForOnline = "no";
    ipv6AcceptRAConfig.DHCPv6Client = "no";
  };

  networking.wireguard.enable = true;
  networking.wireguard.interfaces = {
    # dn42-router-general-wireguard-key public key:
    # r38qvXqu26x4f6yUGxg44Ji4db/g2HK7RZwG7Boh+38=

    # darkpoint
    wg0150 = {
      ips = [
        "fe80::2574/128"
      ];
      postSetup = ''
      ip addr replace dev wg0150 fe80::2574/128 peer fe80::150/128
      '';
      listenPort = 50150;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "fra.darkpoint.xyz:22574";
          publicKey = "nfoxTtmJdBdxNR3TmfVLG13KA5E+ZtU+uIGCegxrxxw=";
        }
      ];
      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
    };
    # e1mo
    wg0565 = {
      ips = [
        "fe80::2574/128"
        # peer fe80::565/128
      ];
      postSetup = ''
      ip -6 route flush dev wg0565
      ip addr del dev wg0565 fe80::2574/128 && ip addr add dev wg0565 fe80::2574/128 peer fe80::565/128
      '';
      listenPort = 50565;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "dn42-nbg1.net.dont-break.it:22574";
          publicKey = "qYaDuYYVpuFqy7KyC5PmJavqs0a7GtyuES8VwugdPSQ=";
        }
      ];
      privateKeyFile = config.sops.secrets.wg0565.path;
    };
    # pilz
    wg0663 = {
      ips = [
        "fe80::1111/128"
      ];
      postSetup = ''
      ip addr replace dev wg0663 fe80::1111/128 peer fe80::acab/128
      '';
      listenPort = 50663;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "dn42.ams1.as214958.net:163";
          publicKey = "NxHkdwZPVL+3HdrHTFOslUpUckTf0dzEG9qpZ0FTBnA=";
        }
      ];
      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
    };
    # prefixlabs
    # https://prefixlabs.net/
    wg1240 = {
      ips = [
        "fe80::2574/128"
      ];
      postSetup = ''
      ip addr replace dev wg1240 fe80::2574/128 peer fe80::1240:11/128
      '';
      listenPort = 51240;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "de-01.prefixlabs.net:22574";
          publicKey = "ixeEBfac1BXpjNKbxcgL6Beg9HTgtmq6CjHIfMwNSDw=";
        }
      ];
      privateKeyFile = config.sops.secrets.wg1240.path;
    };
    # fooker
    wg1271 = {
      ips = [
        "fe80::1/128"
        # peer fe80::2/128
      ];
      postSetup = ''
      ip -6 route flush dev wg1271
      ip addr del dev wg1271 fe80::1/128 && ip addr add dev wg1271 fe80::1/128 peer fe80::2/128
      '';
      listenPort = 51271;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "north.zitadelle.dev.open-desk.net:23425";
          publicKey = "xxPjHWVzePinOOMnuhwGAI3PKY9pvpifIvIbPu3IwQw=";
        }
      ];
      privateKeyFile = config.sops.secrets.wg1271.path;
    };
    wg1272 = {
      ips = [
        "fe80::1:1/128"
        # peer fe80::1:2/128
      ];
      postSetup = ''
      ip -6 route flush dev wg1272
      ip addr del dev wg1272 fe80::1:1/128 && ip addr add dev wg1272 fe80::1:1/128 peer fe80::1:2/128
      '';
      listenPort = 51272;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "south.zitadelle.dev.open-desk.net:23425";
          publicKey = "Iae2R4B7VVsloKWK8T1j1vLMuxpP4dVDUdzEg/YpAjE=";
        }
      ];
      privateKeyFile = config.sops.secrets.wg1272.path;
    };
    # margau
    wg1280 = {
      ips = [
        "fde3:4c0d:2836:ff00::21/127"
        # peer fde3:4c0d:2836:ff00::20/127
      ];
      listenPort = 51280;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "wg1.margau.ipv6.church:51830";
          publicKey = "CEge9jdHQArzdniUiWyB3IUZOjGiew3gPmz/MOf4ahU=";
        }
      ];
      privateKeyFile = config.sops.secrets.wg1280.path;
    };
    # c4tg1rl5
    # https://catgirls.systems/peering/
    wg1411 = {
      ips = [
        "fe80::2574/128"
      ];
      postSetup = ''
      ip addr replace dev wg1411 fe80::2574/128 peer fe80::1411/128
      '';
      listenPort = 51411;
      allowedIPsAsRoutes = false;
      peers = [
        #{
        #  allowedIPs = [ "fe80::/10" "fd00::/8" ];
        #  endpoint = "";
        #  publicKey = "";
        #}
      ];
      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
    };
    # zaphyra
    wg1718 = {
      ips = [
        "fe80::2574/128"
        # peer fe80::6b61/64
      ];
      postSetup = ''
      ip addr replace dev wg1718 fe80::2574/128 peer fe80::6b61/128
      '';
      listenPort = 51718;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "router-a.dn42.zaphyra.eu:51831";
          publicKey = "Knm6uEpMsTfZAK68Pl98mHORtb8TtswBfYFGznpHUCI=";
        }
      ];
      privateKeyFile = config.sops.secrets.wg1718.path;
    };
    # iedon
    # https://iedon.net/
    wg2189 = {
      ips = [
        "fe80::2574/128"
      ];
      postSetup = ''
      ip addr replace dev wg2189 fe80::2574/128 peer fe80::2189:e9/128
      '';
      listenPort = 52189;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "de-fra.dn42.iedon.net:42463";
          publicKey = "FHp0OR4UpAS8/Ra0FUNffTk18soUYCa6NcvZdOgxY0k=";
        }
      ];
      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
    };
    # jona / cryne
    wg3402 = {
      ips = [
        "fe80::2574/128"
      ];
      postSetup = ''
      ip addr replace dev wg3402 fe80::2574/128 peer fe80::3402/128
      '';
      listenPort = 53402;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "dn42.cryne.me:42574";
          publicKey = "YsKInIp90is8ysnQDHGoKnz2CqlTMWMZDmQ+vwvN2C0=";
        }
      ];
      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
    };
    # lutoma
    wg4719 = {
      ips = [
        #"fe80::1/128"
        # peer fe80::acab/128
      ];
      postSetup = ''
      ip addr add dev wg4719 fe80::1/128 peer fe80::acab/128
      '';
      listenPort = 54719;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "[2603:c020:8001:ed42::42]:42546";
          publicKey = "MkVyCgIq0BOStFIu2/Wl91ofFuRvnG3ZqTWFfVs/VlQ=";
        }
      ];
      privateKeyFile = config.sops.secrets.wg4719.path;
    };
    # tbspace
    wg6190 = {
      ips = [
        "fe80::2574/128"
      ];
      postSetup = ''
      ip addr replace dev wg6190 fe80::2574/128 peer fe80::1299:e/128
      '';
      listenPort = 56190;
      allowedIPsAsRoutes = false;
      peers = [
        {
          allowedIPs = [ "fe80::/10" "fd00::/8" ];
          endpoint = "dn42.tbspace.de:49168";
          publicKey = "skvyDl81J8Zu3Ziem+7JKeU4UYLhhWt7gWelg8nEbzQ=";
        }
      ];
      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
    };
  };

  networking.firewall.allowedUDPPorts = [
    50150 # wg0150
    50565 # wg0565
    50663 # wg0663
    51240 # wg1240
    51241 # wg1241
    51271 # wg1271
    51272 # wg1272
    51280 # wg1280
    51411 # wg1411
    51718 # wg1718
    52189 # wg2189
    53402 # wg3402
    54719 # wg4719
    56190 # wg6190
  ];

  profiles.clerie.dn42-router = {
    enable = true;
    loopbackIp = "fd56:4902:eca0:1::1";
    routerId = "192.168.10.23";

    ospfInterfaces = [
      "ens19"
    ];

    ibgpPeers = [
      {
        peerName = "gw5";
        remoteAddress = "fd56:4902:eca0:5::1";
      }
      {
        peerName = "gw6";
        remoteAddress = "fd56:4902:eca0:6::1";
      }
    ];

    wireguardPeers = [
      {
        peerName = "peer_0150";
        remoteAddress = "fe80::150";
        interfaceName = "wg0150";
        remoteAsn = "4242420150";
        localAddress = "fe80::2574";
      }
      {
        peerName = "peer_0565";
        remoteAddress = "fe80::565";
        interfaceName = "wg0565";
        remoteAsn = "4242420565";
        localAddress = "fe80::2574";
      }
      {
        peerName = "peer_0663";
        remoteAddress = "fe80::acab";
        interfaceName = "wg0663";
        remoteAsn = "4242420663";
        localAddress = "fe80::1111";
      }
      {
        peerName = "peer_1240_de_01";
        remoteAddress = "fe80::1240:11";
        interfaceName = "wg1240";
        remoteAsn = "4242421240";
        localAddress = "fe80::2574";
      }
      {
        peerName = "peer_1271_north";
        remoteAddress = "fe80::2";
        interfaceName = "wg1271";
        remoteAsn = "4242421271";
        localAddress = "fe80::1";
      }
      {
        peerName = "peer_1271_south";
        remoteAddress = "fe80::1:2";
        interfaceName = "wg1272";
        remoteAsn = "4242421271";
        localAddress = "fe80::1:1";
      }
      {
        peerName = "peer_1280_wg1";
        remoteAddress = "fde3:4c0d:2836:ff00::20";
        interfaceName = "wg1280";
        remoteAsn = "4242421280";
        localAddress = "fde3:4c0d:2836:ff00::21";
      }
      {
        peerName = "peer_1411_de_fsn";
        remoteAddress = "fe80::1411";
        interfaceName = "wg1411";
        remoteAsn = "4242421411";
        localAddress = "fe80::2574";
      }
      {
        peerName = "peer_1718";
        remoteAddress = "fe80::6b61";
        interfaceName = "wg1718";
        remoteAsn = "4242421718";
        localAddress = "fe80::2574";
      }
      {
        peerName = "peer_2189_de_fra";
        remoteAddress = "fe80::2189:e9";
        interfaceName = "wg2189";
        remoteAsn = "4242422189";
        localAddress = "fe80::2574";
      }
      {
        peerName = "peer_3402";
        remoteAddress = "fe80::3402";
        interfaceName = "wg3402";
        remoteAsn = "4242423402";
        localAddress = "fe80::2574";
      }
      {
        peerName = "peer_4719";
        remoteAddress = "fe80::acab";
        interfaceName = "wg4719";
        remoteAsn = "64719";
        localAddress = "fe80::1";
      }
      {
        peerName = "peer_6190";
        remoteAddress = "fe80::1299:e";
        interfaceName = "wg6190";
        remoteAsn = "76190";
        localAddress = "fe80::2574";
      }
    ];
  };

  services.bijwerken = {
    autoUpgrade = true;
  };

  clerie.monitoring = {
    enable = true;
    id = "301";
    pubkey = "kTuC3/rLr4Qb3C4oEn1ecB/vS78poxmu6/Id3Rc1VGY=";
    bird = true;
  };

  system.stateVersion = "21.03";
}