{ pkgs, unstable, lib, config, ... }:
let
  hosts = import ../../hosts.nix;
in
{
  # age.secrets = {
  #   ntfy-freya = { file = ../../secrets/ntfy-freya.age; owner = "bertof"; };
  # };

  boot.loader = {
    systemd-boot.enable = true;
    efi.canTouchEfiVariables = true;
  };

  console = {
    font = "Lat2-Terminus16";
    keyMap = "it";
  };

  environment = {
    pathsToLink = [ "/share/zsh" ];
    systemPackages = builtins.attrValues {
      inherit (pkgs)
        helix tmux vim
        exiftool nodejs# for Nextcloud
        ;
    };
  };

  hardware = {
    bluetooth = {
      enable = true;
      # package = pkgs.bluezFull;
    };
    graphics.enable = true;
    # amdgpu.amdvlk.enable = true;
  };

  i18n.defaultLocale = "it_IT.UTF-8";

  networking.hostName = "heimdall";
  networking.firewall = {
    enable = true;
    allowPing = true;
    allowedTCPPorts = [
      # 445 # SAMBA
      # 139 # SAMBA
      # 5357 # SAMBA-WSDD
      # 8123 # HOME ASSISTANT
      8384 # SYNCTHING
      # 8385 # SYNCTHING
    ];
    allowedUDPPorts = [
      137 # SYNCTHING
      138 # SYNCTHING
      # 3702 # SAMBA-WSDD
    ];
    # extraCommands =
    #   "iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns";
  };

  programs = {
    fuse.userAllowOther = true;
    dconf.enable = true;
    gnupg.agent = {
      enable = true;
      enableSSHSupport = true;
    };
    zsh.enable = true;
  };

  security.sudo.extraConfig = ''
    Defaults pwfeedback
  '';
  users.users.zigbee2mqtt.extraGroups = [ "dialout" ];

  services = {
    garage.settings.data_dir = "/mnt/raid/garage/";
    gitlab-runner = {
      enable = true;
      services = {
        # runner for building docker images
        docker-images = {
          limit = 3;
          authenticationTokenConfigFile = config.age.secrets.heimdall-gitlab-runner-docker-images.path;

          dockerImage = "docker:stable";
          dockerVolumes = [
            "/var/run/docker.sock:/var/run/docker.sock"
          ];
        };
        # runner for everything else
        default = {
          limit = 3;
          authenticationTokenConfigFile = config.age.secrets.heimdall-gitlab-runner-default.path;
          dockerImage = "debian:stable";
        };
      };
    };

    immich.mediaLocation = "/mnt/raid/immich";

    mosquitto = {
      enable = true;
      listeners = [{
        address = "127.0.0.1";
        port = 1883;
        users.zigbee2mqtt = {
          acl = [
            "readwrite #"
          ];
          password = "zigbee2mqtt";
        };
      }];
    };
    zigbee2mqtt = {
      enable = true;
      settings = {
        mqtt = {
          user = "zigbee2mqtt";
          password = "zigbee2mqtt";
          client_id = "zigbee2mqtt";
        };
        frontend.enabled = true;
        # permit_join = true;
        serial = {
          port = "/dev/serial/by-id/usb-1a86_USB_Serial-if00-port0";
          adapter = "ember";
        };
      };
    };
    # grafana = {
    #   enable = true;
    #   settings.server = {
    #     http_addr = "0.0.0.0";
    #     domain = "bertof.net";
    #     root_url = "https://grafana.bertof.net/";
    #   };
    # };

    #   avahi = {
    #     enable = true;
    #     openFirewall = true;
    #     nssmdns4 = true;
    #     publish = {
    #       enable = true;
    #       addresses = true;
    #       domain = true;
    #       userServices = true;
    #       workstation = true;
    #     };
    #     extraServiceFiles.ssh = "${pkgs.avahi}/etc/avahi/services/ssh.service";
    #   };
    #   blueman.enable = true;
    #   dbus.packages = [ pkgs.dconf ];
    #   gnome.gnome-keyring.enable = true;
    openssh = {
      enable = true;
      openFirewall = true;
    };
    #   # xserver = {
    #   #   enable = true;
    #   #   desktopManager.retroarch = { enable = true; package = pkgs.retroarchFull; };
    #   # };
    #
    fail2ban = {
      enable = true;
      bantime-increment.enable = true;
    };
    jellyfin = {
      enable = true;
      openFirewall = true;
      group = "users";
    };
    #
    home-assistant = {
      enable = true;
      package = unstable.home-assistant;
      openFirewall = true;
      config = {
        default_config = { };

        homeassistant = {
          name = "Casa";
          latitude = "!secret home-latitude";
          longitude = "!secret home-longitude";
          country = "IT";
          elevation = 24;
          unit_system = "metric";
          time_zone = "Europe/Rome";
          external_url = "https://hass.bertof.net";
          allowlist_external_dirs = [ "/tmp" ];
        };

        http = {
          use_x_forwarded_for = true;
          trusted_proxies = [
            hosts.tailscale.ipv4."baldur"
            "::1"
            "127.0.0.1"
          ];
        };

        automation = "!include automations.yaml";
        scene = "!include scenes.yaml";
        alert = "!include alerts.yaml";

        alarm_control_panel = {
          platform = "manual";
          code = "!secret alarm_code";
          trigger_time = 60;
        };

        assist_pipeline = { };
        # bluetooth = { };
        camera = [ ];
        cloud = { };
        config = { };
        image_processing = [ ]; # esphome = { };
        frontend = { };
        google_assistant = {
          project_id = "home-assistant-milano";
          report_state = true;
          service_account = "!include google-service-account.json";
          exposed_domains = [
            "alarm_control_panel"
            "button"
            "camera"
            "climate"
            "cover"
            "fan"
            "group"
            "humidifier"
            "input_boolean"
            "input_button"
            "input_select"
            "light"
            "lock"
            "media_player"
            "scene"
            "script"
            "select"
            "sensor"
            "switch"
            "vacuum"
          ];
        };
        history = { };
        logbook = { };
        # logger.default = "debug";
        logger.default = "info";
        # "map" = { };
        mobile_app = { };
        notify = [
          # { platform = "telegram"; name = "t_filippo"; chat_id = "!secret filippo_t_chat_id"; }
          # { platform = "telegram"; name = "t_famiglia"; chat_id = "!secret famiglia_t_chat_id"; }
        ];
        recorder.purge_keep_days = 30;
        script = "!include scripts.yaml";
        system_health = { };
        tts = [{ platform = "google_translate"; language = "it"; }];
      };
      configDir = "/var/lib/hass";
      configWritable = true;
      extraPackages = ps: with ps; [ securetar ];
      customComponents = with unstable.home-assistant-custom-components; [ adaptive_lighting ];
      extraComponents = [
        "default_config"

        # "accuweather"
        "alert"
        "analytics"
        # "androidtv"
        # "androidtv_remote"
        "bayesian"
        "binary_sensor"
        "blueprint"
        "bluetooth_le_tracker"
        # "bluetooth_tracker"
        "button"
        "camera"
        "cast"
        "caldav"
        "calendar"
        "citybikes"
        "co2signal"
        "color_extractor"
        "configurator"
        # "coronavirus"
        "cover"
        "default_config"
        "derivative"
        "device_automation"
        "device_sun_light_trigger"
        "device_tracker"
        "dlna_dmr"
        "dlna_dms"
        "esphome"
        "google"
        "google_translate"
        "group"
        "hassio"
        "home_connect"
        "jellyfin"
        "local_file"
        "media_player"
        "mqtt"
        "met"
        "meteoalarm"
        "network"
        # "nextcloud"
        "nmap_tracker"
        "ollama"
        "open_meteo"
        "notify"
        "ping"
        "proximity"
        "radarr"
        "radio_browser"
        "random"
        "scene"
        "schedule"
        "script"
        "sonarr"
        "speedtestdotnet"
        "spotify"
        "tailscale"
        "tcp"
        # "telegram"
        # "telegram_bot"
        "template"
        "threshold"
        "transmission"
        "tod" # times of the day
        "trend"
        "tuya"
        "upnp"
        "uptime_kuma"
        "wake_on_lan"
        "webostv"
        "wled"
        "workday"
        "zha"
        "zoneminder"
      ];
    };

    snapper.configs = let common = { TIMELINE_CREATE = true; TIMELINE_CLEANUP = true; }; in {
      bertof = lib.recursiveUpdate common { SUBVOLUME = "/mnt/raid/bertof/"; ALLOW_USERS = [ "bertof" ]; };
      tiziano = lib.recursiveUpdate common { SUBVOLUME = "/mnt/raid/tiziano/"; ALLOW_USERS = [ "tiziano" ]; };
      condiviso = lib.recursiveUpdate common { SUBVOLUME = "/mnt/raid/condiviso"; ALLOW_USERS = [ "bertof" "tiziano" ]; };
      immich = lib.recursiveUpdate common { SUBVOLUME = "/mnt/raid/immich"; ALLOW_USERS = [ "bertof" ]; };
      garage = lib.recursiveUpdate common { SUBVOLUME = "/mnt/raid/garage"; ALLOW_USERS = [ "bertof" ]; };
    };
  };

  time.timeZone = "Europe/Rome";

  zramSwap.enable = true;

  system.stateVersion = "24.05";
}