{ config, pkgs, ... }:
{
    imports = [
        ./forgejo.nix
        ./tls_sni.nix
    ];

    boot.loader.grub.enable = true;
    boot.loader.grub.device = "/dev/sda";

    networking.hostName = "Emitter";

    networking.tempAddresses = "disabled";
    networking.useDHCP = false;
    networking = {
        defaultGateway = {
            address = "176.96.139.1";
            interface = "ens18";
        };
        defaultGateway6 = {
            address = "2a0d:5940:80:4e::1";
            interface = "ens18";
        };
        nameservers = [
            "9.9.9.10"
            "8.8.8.8"
            "2606:4700:4700::1111"
            "2001:4860:4860::8888"
        ];
        interfaces.ens18 = {
            ipv4 = {
                addresses = [
                    {
                        address = "176.96.139.54";
                        prefixLength = 24;
                    }
                ];
                routes = [
                    {
                        address = "176.96.139.0";
                        prefixLength = 24;
                        via = "176.96.139.1";
                    }
                ];
            };
            ipv6 = {
                addresses = [
                    {
                        address = "2a0d:5940:80:4e::2";
                        prefixLength = 64;
                    }
                    {
                        address = "fe80::4874:40ff:fe38:7a45";
                        prefixLength = 64;
                    }
                ];
                routes = [
                    {
                        address = "2a0d:5940:80:4e::2";
                        prefixLength = 64;
                        via = "2a0d:5940:80:4e::1";
                    }
                ];
            };
        };
    };

    i18n.defaultLocale = "de_DE.UTF-8";
    console.keyMap = "de";

    services.openssh.ports = [ 8248 ];
    networking.firewall.allowedTCPPorts = [ 8248 ];

    nix.settings.trusted-users = [ "fruchti" ];
    security.sudo.wheelNeedsPassword = false;

    security.acme = {
        defaults = {
            email = config.email.adminEmail;
        };
        acceptTerms = true;
    };

    system.autoUpgrade = {
        enable = true;
        allowReboot = true;
        sendEmail = true;
        gitPull = true;
        gitUser = "fruchti";
    };


    nixpkgs.overlays = [
        (self: super: {
            burp = (super.burp.overrideAttrs (old: {
                postInstall = ''
                    mv $out/sbin/burp $out/sbin/burp-untunneled
                    cat > $out/sbin/burp <<-EOF
                    #!/${pkgs.bash}/bin/bash
                    set -e
                    echo "Ensuring rupert.gvfr.de is up."
                    ${pkgs.dig}/bin/nslookup rupert.gvfr.de
                    ${pkgs.unixtools.ping}/bin/ping -c1 rupert.gvfr.de >/dev/null
                    echo "Opening SSH tunnel."
                    ${pkgs.openssh}/bin/ssh -6 -i /secrets/id_burp_remote -o IdentitiesOnly=yes -o ExitOnForwardFailure=yes -L 4971:localhost:4971 burp-remote@rupert.gvfr.de -f true
                    echo "Beginning backup operation."
                    $out/sbin/burp-untunneled \$@
                    EOF
                    chmod +x $out/sbin/burp
                '';
            }));
        })
    ];

    services.burp = {
        client = {
            enable = true;
            # Because of the port forward, the server will be localhost
            server = "localhost";
            frequency = "3:00";
            passwordFile = "/secrets/burp_client_password";
            sslKeyPasswordFile = "/secrets/burp_ssl_key_password";
        };
    };
    services.statusEmail.enable = true;
    systemd.services.burp-client = let
        retryDelay = 10 * 60;
        maxRetries = 5;
    in {
        unitConfig = {
            OnFailure = "status-email@%n.service";
            StartLimitIntervalSec = (maxRetries + 1) * retryDelay;
            StartLimitBurst = maxRetries;
        };
        serviceConfig = {
            Restart = "on-failure";

            RestartSec = retryDelay;
            # Skip transitions through failed state, i.e. don’t send a e-mail
            # before the maximum number of retries is exhausted
            RestartMode = "direct";
        };
    };

    services.postgresql.package = pkgs.postgresql_13;

    # This value determines the NixOS release from which the default
    # settings for stateful data, like file locations and database versions
    # on your system were taken. It’s perfectly fine and recommended to leave
    # this value at the release version of the first install of this system.
    # Before changing this value read the documentation for this option
    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
    system.stateVersion = "21.11"; # Did you read the comment?
}

