{ pkgs, config, ... }:
let
  hosts = import ../../hosts.nix;
in
{

  age.secrets = {
    ntfy-loki = {
      file = ../../secrets/ntfy-loki.age;
      owner = "bertof";
    };
  };

  boot = {
    binfmt.emulatedSystems = [
      "armv7l-linux"
      "aarch64-linux"
    ];
    # kernelPackages = pkgs.linuxPackages_latest;
    loader = {
      systemd-boot.enable = true;
      efi.canTouchEfiVariables = true;
    };
  };

  console = {
    font = "Lat2-Terminus16";
    keyMap = "it";
  };

  environment = {
    pathsToLink = [ "/share/zsh" ];
    systemPackages = builtins.attrValues { inherit (pkgs) helix tmux vim; };
  };

  hardware = {
    enableRedistributableFirmware = true;

    # nvidia.package = config.boot.kernelPackages.nvidiaPackages.legacy_470;
    # nvidia.nvidiaPersistenced = true; # HEADLESS
    # nvidia.prime = {
    #   offload.enable = false;
    #   sync.enable = true;
    #   intelBusId = "PCI:0:2:0";
    #   nvidiaBusId = "PCI:1:0:0";
    # };

    graphics = {
      enable = true;
      extraPackages = builtins.attrValues {
        inherit (pkgs)
          intel-media-driver
          libvdpau-va-gl
          vaapiIntel
          vaapiVdpau
          ;
      };
    };

    bluetooth.enable = true;
  };

  i18n.defaultLocale = "it_IT.UTF-8";

  programs = {
    dconf.enable = true;
    gnupg.agent = {
      enable = true;
      enableSSHSupport = true;
    };
    zsh.enable = true;
  };

  networking = {
    hostName = "loki";
    interfaces.eno1.useDHCP = true;
    # networkmanager.enable = true;
    # useDHCP = false;
  };

  time.timeZone = "Europe/Rome";

  services = {
    # avahi = {
    #   enable = true;
    #   openFirewall = true;
    #   nssmdns4 = true;
    #   publish = {
    #     enable = true;
    #     addresses = true;
    #     domain = true;
    #     userServices = true;
    #     workstation = true;
    #   };
    #   extraServiceFiles = {
    #     ssh = "${pkgs.avahi}/etc/avahi/services/ssh.service";
    #   };
    # };
    # bazarr = { enable = true; openFirewall = true; group = "users"; };
    blueman.enable = true;
    dbus = { packages = [ pkgs.dconf ]; implementation = "broker"; };
    esphome = { enable = true; openFirewall = true; };
    # fail2ban = { enable = true; bantime-increment.enable = true; };
    gnome.gnome-keyring.enable = true;
    gvfs.enable = true;
    # jackett = { enable = true; openFirewall = true; group = "users"; };
    # jellyfin = { enable = true; openFirewall = true; group = "users"; };
    logind.lidSwitch = "ignore";
    # node-red = { enable = true; openFirewall = true; withNpmAndGcc = true; };
    openssh = { enable = true; openFirewall = true; };
    # plex = { enable = true; openFirewall = true; group = "users"; };
    # power-profiles-daemon.enable = true;
    # prowlarr = { enable = true; openFirewall = true; };
    # radarr = { enable = true; openFirewall = true; group = "users"; };
    # samba-wsdd = { enable = true; discovery = true; };
    # samba = {
    #   enable = true;
    #   enableNmbd = true;
    #   enableWinbindd = true;
    #   nsswins = true;
    #   extraConfig = ''
    #     workgroup = WORKGROUP
    #     load printers = no
    #     smb encrypt = required
    #   '';
    #   shares =
    #     let
    #       common = {
    #         "public" = "no";
    #         "writeable" = "yes";
    #         "create mask" = "0700";
    #         "directory mask" = "2700";
    #         "browseable" = "yes";
    #         "guest ok" = "no";
    #         "read only" = "no";
    #         "force group" = "users";
    #       };
    #     in
    #     {
    #       bertof = lib.recursiveUpdate common {
    #         path = "/home/bertof/";
    #         comment = "Bertof samba share";
    #         "force user" = "bertof";
    #         "valid users" = "bertof";
    #       };
    #       tiziano = lib.recursiveUpdate common {
    #         path = "/home/tiziano/";
    #         comment = "Tiziano samba share";
    #         "force user" = "tiziano";
    #         "valid users" = "tiziano";
    #       };
    #       condiviso = lib.recursiveUpdate common {
    #         path = "/mnt/condiviso";
    #         comment = "Samba share condiviso";
    #         "valid users" = "bertof tiziano";
    #         "create mask" = "0770";
    #         "directory mask" = "2770";
    #         "force create mode" = "0660";
    #         "force directory mode" = "2770";
    #       };
    #     };
    # };
    smartd.enable = true;
    # sonarr = { enable = true; openFirewall = true; group = "users"; };
    thermald.enable = true;
    # transmission = {
    #   enable = true;
    #   openFirewall = true;
    #   group = "users";
    #   settings = {
    #     download-dir = "/mnt/condiviso/Torrent";
    #     incomplete-dir = "/mnt/condiviso/Torrent/.incomplete";
    #   };
    # };
    xserver = {
      # enable = true;
      # videoDrivers = [ "nvidia" ];
      # layout = "it";
      # xkbOptions = "eurosign:e;";
      # libinput.enable = true;
    };

    # zoneminder = {
    #   enable = true;
    #   openFirewall = true;
    #   cameras = 3;
    #   hostname = "0.0.0.0";
    #   database = {
    #     username = "zoneminder";
    #     createLocally = true;
    #   };
    # };

    # mysql = {
    #   # enable = true;
    #   ensureUsers = [{
    #     name = "bertof";
    #     ensurePermissions = { "*.*" = "ALL PRIVILEGES"; };
    #   }];
    # };
  };

  # services.snapper = {
  #   configs =
  #     let
  #       common = {
  #         TIMELINE_CREATE = true;
  #         TIMELINE_CLEANUP = true;
  #       };
  #     in
  #     {
  #       bertof = lib.recursiveUpdate common { SUBVOLUME = "/home/bertof/"; ALLOW_USERS = [ "bertof" ]; };
  #       tiziano = lib.recursiveUpdate common { SUBVOLUME = "/home/tiziano/"; ALLOW_USERS = [ "tiziano" ]; };
  #       condiviso = lib.recursiveUpdate common { SUBVOLUME = "/mnt/condiviso"; ALLOW_USERS = [ "bertof" "tiziano" ]; };
  #     };
  # };

  networking.firewall = {
    enable = true;
    allowPing = true;
    allowedTCPPorts = [
      445 # SAMBA
      139 # SAMBA
      5357 # SAMBA-WSDD
      8123 # HOME ASSISTANT
      8384 # SYNCTHING
      8385 # SYNCTHING
    ];
    allowedUDPPorts = [
      137 # SYNCTHING
      138 # SYNCTHING
      3702 # SAMBA-WSDD
    ];
    extraCommands = "iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns";
  };

  virtualisation = {
    # docker.enable = true;
    # kvmgt.enable = true;
    # libvirtd.enable = true;
    # podman.enable = true;
    # virtualbox.host.enable = true;

    # oci-containers.containers = {
    #   doods2 = {
    #     image = "docker.io/snowzach/doods2:latest";
    #     # environment = { TZ = "Europe/Rome"; };
    #     extraOptions = [ "--pull=always" ];
    #     ports = [ "127.0.0.1:8080:8080" ];
    #     # volumes = [ "/var/lib/hass:/config" "/mnt/raid0/condiviso:/media" ];
    #   };
    # };

  };

  services.home-assistant = {
    enable = true;
    openFirewall = true;
    config = {
      default_config = { };

      homeassistant = {
        name = "Casa";
        latitude = "!secret home-latitude";
        longitude = "!secret home-longitude";
        country = "IT";
        elevation = 17;
        unit_system = "metric";
        time_zone = "Europe/Rome";
        external_url = "https://home-assistant.bertof.net";
        allowlist_external_dirs = [ "/tmp" ];
      };

      http = {
        use_x_forwarded_for = true;
        trusted_proxies = [
          hosts.zerotier.ipv4."baldur.zto"
          hosts.tailscale.ipv4."baldur.tsn"
          "::1"
          "127.0.0.1"
        ];
      };

      automation = "!include automations.yaml";
      scene = "!include scenes.yaml";
      alert = "!include alert.yaml";

      alarm_control_panel = {
        platform = "manual";
        code = "!secret alarm_code";
        trigger_time = 60;
      };

      assist_pipeline = { };
      # bluetooth = { };
      camera = [
        # {
        #   platform = "local_file";
        #   file_path = "/tmp/doods_camera_camera_cancello.jpg";
        #   name = "File DOODS2 Camera cancello";
        # }
        # {
        #   platform = "local_file";
        #   file_path = "/tmp/doods_camera_camera_vialetto.jpg";
        #   name = "File DOODS2 Camera vialetto";
        # }
        # {
        #   platform = "local_file";
        #   file_path = "/tmp/doods_camera_camera_garage.jpg";
        #   name = "File DOODS2 Camera garage";
        # }
      ];
      cloud = { };
      config = { };
      # device_tracker = [{
      #   platform = "bluetooth_tracker";
      #   request_rssi = true;
      # }];
      # image_processing = [
      #   {
      #     platform = "doods";
      #     url = "http://localhost:8080";
      #     detector = "default";
      #     source = [
      #       {
      #         entity_id = "camera.camera_camera_cancello";
      #         name = "DOODS2 Camera cancello";
      #       }
      #       {
      #         entity_id = "camera.camera_camera_vialetto";
      #         name = "DOODS2 Camera vialetto";
      #       }
      #       {
      #         entity_id = "camera.camera_camera_garage";
      #         name = "DOODS2 Camera garage";
      #       }
      #     ];
      #     confidence = 60;
      #     file_out = "/tmp/doods_{{ camera_entity.split('.')[1] }}.jpg";
      #     scan_interval = 5;
      #     labels = [
      #       "bicycle"
      #       "car"
      #       "cat"
      #       "dog"
      #       "person"
      #       "truck"
      #     ];
      #   }
      # ];
      # esphome = { };
      frontend = { };
      google_assistant = {
        project_id = "home-assistant-390217";
        report_state = true;
        service_account = "!include google-service-account.json";
        exposed_domains = [
          "alarm_control_panel"
          "button"
          "camera"
          "climate"
          "cover"
          "fan"
          "group"
          "humidifier"
          "input_boolean"
          "input_button"
          "input_select"
          "light"
          "lock"
          "media_player"
          "scene"
          "script"
          "select"
          "switch"
          "vacuum"
        ];
      };
      history = { };
      logbook = { };
      # logger.default = "debug";
      logger.default = "info";
      # "map" = { };
      mobile_app = { };
      notify = [
        # { platform = "telegram"; name = "t_filippo"; chat_id = "!secret filippo_t_chat_id"; }
        # { platform = "telegram"; name = "t_famiglia"; chat_id = "!secret famiglia_t_chat_id"; }
      ];
      recorder.purge_keep_days = 30;
      script = "!include scripts.yaml";
      shopping_list = { };
      sun = { };
      system_health = { };
      # telegram_bot = [{
      #   # platform = "polling";
      #   platform = "webhooks";
      #   api_key = "!secret telegram_api_key";
      #   allowed_chat_ids = [
      #     "!secret filippo_t_chat_id"
      #     "!secret famiglia_t_chat_id"
      #   ];
      # }];
      tts = [
        {
          platform = "google_translate";
          language = "it";
          # tld = "it";
        }
      ];
    };
    configDir = "/var/lib/hass";
    configWritable = true;
    extraPackages = ps: with ps; [ securetar ];
    extraComponents = [
      "default_config"

      "alert"
      "analytics"
      "androidtv"
      "androidtv_remote"
      "bayesian"
      "binary_sensor"
      "blueprint"
      # "bluetooth_le_tracker"
      # "bluetooth_tracker"
      "button"
      "camera"
      "cast"
      "caldav"
      "calendar"
      "citybikes"
      "configurator"
      # "coronavirus"
      "cover"
      "default_config"
      "derivative"
      "device_automation"
      "device_sun_light_trigger"
      "device_tracker"
      "dlib_face_detect"
      "dlib_face_identify"
      "dlna_dmr"
      "dlna_dms"
      "esphome"
      "flux"
      "gdacs"
      "google"
      "google_translate"
      "group"
      "hassio"
      "jellyfin"
      "local_file"
      "media_player"
      "met"
      "meteoalarm"
      "network"
      # "nextcloud"
      "nmap_tracker"
      "notify"
      "open_meteo"
      "ping"
      "plex"
      "proximity"
      "radarr"
      "radio_browser"
      "random"
      "scene"
      "schedule"
      "script"
      "sonarr"
      "speedtestdotnet"
      "spotify"
      "tcp"
      # "telegram"
      # "telegram_bot"
      "template"
      "threshold"
      "transmission"
      "tod" # times of the day
      "trend"
      "tuya"
      "upnp"
      "wake_on_lan"
      "wled"
      "workday"
      "zha"
      "zoneminder"
    ];
  };

  services.prometheus = {
    enable = true;
    exporters = {
      node = {
        enable = true;
        enabledCollectors = [ "systemd" ];
      };
      process = {
        enable = true;
        settings.process_names = [
          # Remove nix store path from process name
          {
            name = "{{.Matches.Wrapped}} {{ .Matches.Args }}";
            cmdline = [ "^/nix/store[^ ]*/(?P<Wrapped>[^ /]*) (?P<Args>.*)" ];
          }
        ];
      };
      systemd.enable = true;
    };
    globalConfig = {
      scrape_interval = "10s";
    };
    scrapeConfigs = [
      {
        job_name = "node";
        static_configs = [
          { targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ]; }
        ];
      }
      {
        job_name = "process";
        static_configs = [
          { targets = [ "localhost:${toString config.services.prometheus.exporters.process.port}" ]; }
        ];
      }
      {
        job_name = "systemd";
        static_configs = [
          { targets = [ "localhost:${toString config.services.prometheus.exporters.systemd.port}" ]; }
        ];
      }
    ];
    retentionTime = "15d";
  };

  security.sudo.extraConfig = ''
    Defaults pwfeedback
  '';

  system.stateVersion = "22.11";
}