{ config, pkgs, lib, ... }:
let
  mwnSubnetsPublic =
    [ "129.187.0.0/16" "141.40.0.0/16" "141.84.0.0/16"
      "192.68.211.0/24" "192.68.212.0/24" "192.68.213.0/24" "192.68.214.0/24" "192.68.215.0/24"
      "193.174.96.0/22"
      "194.95.59.0/24"
    ];
  mwnSubnetsPrivate =
    [ "10.153.0.0/16" "10.162.0.0/16" "10.156.0.0/16"
    ];
in {
  config = {
    systemd.network = {
      config.routeTables.wgrz = 1025;
      netdevs = {
        wgrz = {
          netdevConfig = {
            Name = "wgrz";
            Kind = "wireguard";
            MTUBytes = "1558";
          };
          wireguardConfig = {
            PrivateKeyFile = "/run/credentials/systemd-networkd.service/wgrz.priv";
            ListenPort = 51822;
            # FirewallMark = 1;
          };
          wireguardPeers = [
            { AllowedIPs = [ "10.200.116.1/32" "10.163.88.40/32" ] ++ mwnSubnetsPrivate ++ mwnSubnetsPublic;
              PublicKey = "YlRFLc+rD2k2KXl7pIJbOKbcPgdJCl8ZTsv0xlK4VEI=";
              PersistentKeepalive = 25;
              Endpoint = "wg.math.lmu.de:51820";
            }
          ];
        };
      };
      networks = {
        wgrz = {
          name = "wgrz";
          matchConfig = {
            Name = "wgrz";
          };
          address = ["10.200.116.131/24"];
          routes = map (Destination: {
            inherit Destination;
            Gateway = "10.200.116.1";
            GatewayOnLink = true;
            Table = "wgrz";
          }) (mwnSubnetsPrivate ++ mwnSubnetsPublic ++ ["10.163.88.40/32"]);
          routingPolicyRules = [
            { Table = "main";
              # FirewallMark = 1;
              To = "129.187.111.225";
              Priority = 100;
            }
            { Table = "main";
              To = "10.153.91.204";
              Priority = 100;
            }
            { Table = "wgrz";
              From = "10.200.116.131";
              Priority = 200;
            }
            { Table = "wgrz";
              To = "10.163.88.40";
              Priority = 200;
            }
          ] ++ map (To: { Table = "wgrz";
                          inherit To;
                          Priority = 200;
                        }) (mwnSubnetsPrivate ++ mwnSubnetsPublic);
          linkConfig = {
            RequiredForOnline = false;
          };
          networkConfig = {
            LLMNR = false;
            MulticastDNS = false;
            DNS = ["10.153.88.9" "129.187.111.202" "10.156.33.53"];
            # Tunnel = "rz-gre-1";
          };
        };
      };
    };
    networking.networkmanager.unmanaged = ["wgrz"];
    sops.secrets.wgrz = {
      format = "binary";
      sopsFile = ./wgrz.priv;
    };
    systemd.services."systemd-networkd".serviceConfig.LoadCredential = [
      "wgrz.priv:${config.sops.secrets.wgrz.path}"
    ];

    environment.etc."NetworkManager/dnsmasq.d/wgrz.conf" = {
      text = ''
        server=/mathinst.loc/10.153.88.9@wgrz
        server=/cipmath.loc/10.153.88.9@wgrz
      '';
    };

    home-manager.users.gkleen = { sysConfig, config, lib, ... }: {
      home.persistence."/persistent" = {
        files = [
          "rz.kdbx"
        ];
        directories = [
          ".config/Element-lmu" ".config/worktime"
          ".config/chromium-kimai" ".config/chromium-rainbow"
        ];
      };

      xdg.desktopEntries = {
        element-lmu = {
          name = "Element (LMU)";
          exec = "element-desktop --profile=lmu %u";
          icon = "element";
          genericName = "Matrix Client";
          categories = [ "Network" "InstantMessaging" "Chat" ];
          settings = {
            StartupWMClass = "Element";
          };
        };
        thunderbird-lmu = {
          name = "Thunderbird (LMU)";
          exec = "thunderbird --name thunderbird -P lmu %U";
          icon = "thunderbird";
          genericName = "Email Client";
          categories = [ "Network" "Chat" "Email" "Feed" "GTK" "News" ];
          settings = {
            StartupWMClass = "thunderbird";
            StartupNotify = "true";
          };
        };
        rainbow = {
          name = "Rainbow";
          exec = toString (pkgs.writeShellScript "rainbow" ''
            exec -- \
              ${lib.getExe' sysConfig.systemd.package "systemd-run"} --wait --user --slice-inherit \
              --property 'CPUAccounting=yes' --property 'CPUQuotaPeriodSec=50ms' \
              -E DSCP=46 -E NIXOS_OZONE_WL \
              -- ${lib.getExe pkgs.dscp} ${lib.getExe config.programs.chromium.package} \
              --class=Rainbow \
              --app="https://web.openrainbow.com" \
              --user-data-dir=''${HOME}/.config/chromium-rainbow
          '');
          icon = pkgs.fetchurl {
            url = "https://web.openrainbow.com/rb/2.174.21/assets/skins/rainbow/images/homepage/logo__rainbow.svg";
            hash = "sha256-5fmo8rDqVDpzkGaPjk4Y+SsSZpAsY7VUQSFW6WdHwuU=";
          };
          settings = {
            StartupWMClass = "Rainbow";
          };
        };
        kimai = {
          name = "Kimai";
          exec = toString (pkgs.writeShellScript "kimai" ''
            exec -- \
              ${lib.getExe config.programs.chromium.package} \
              --class=Kimai \
              --app="https://kimai.yggdrasil.li" \
              --user-data-dir=''${HOME}/.config/chromium-kimai
          '');
          icon = pkgs.fetchurl {
            url = "https://www.kimai.org/images/kimai_logo.png";
            hash = "sha256-lnlOttzR2SwXA70R+egJUkeKr4U5V0avqTk8uX4bqfs=";
          };
          settings = {
            StartupWMClass = "Kimai";
            StartupNotify = "true";
          };
        };
      };

      programs.zsh.dirHashes = {
        u2w = "$HOME/projects/uni2work";
        rz = "$HOME/projects/rz";
        pro = "$HOME/projects/pro";
      };

      programs.ssh.matchBlocks = let
        autosshProxy = host: "${lib.getExe pkgs.socat} - SOCKS4A:127.0.0.1:%h:%p,socksport=${toString config.services.autosshProxy.${host}.port}";
      in {
        "repo-apt01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
          user = "root";
          hostname = "repo-apt01.mathinst.loc";
          proxyCommand = autosshProxy "mgmt01";
        };
        "mgmt01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
          user = "root";
          hostname = "mgmt01.mathinst.loc";
          proxyCommand = autosshProxy "mathw0h";
        };
        "mathw0e" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
          hostname = "mathw0e.mathinst.loc";
          proxyCommand = autosshProxy "mathw0h";
        };
        "cip04" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
          hostname = "cip04.cipmath.loc";
          proxyCommand = autosshProxy "mathw0h";
        };
        "mathw0h" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
          hostname = "mathw0h.mathinst.loc";
          proxyCommand = autosshProxy "ssh.math.lmu.de";
        };
        "math05"  = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
          hostname = "math05.mathinst.loc";
          proxyCommand = autosshProxy "mathw0h";
          extraOptions.KexAlgorithms = "+diffie-hellman-group1-sha1";
        };
        "*.mathinst.loc" = {
          match = "host *.mathinst.loc,*.cipmath.loc,*.math.lmu.de";
          identityFile = "~/.ssh/gkleen@mathinst.loc";
          extraOptions = {
            HostKeyAlgorithms = "+ssh-rsa";
            PubkeyAcceptedAlgorithms = "+ssh-rsa";
            PasswordAuthentication = "yes";
            GlobalKnownHostsFile = toString (pkgs.writeText "ssh_known_hosts" ''
              @cert-authority *.mathinst.loc,*.math.lmu.de,*.cipmath.loc ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUTFpVCdETCXiDSDl7YGbR1J4BLTsoBzjDtflHJGO/z ssh-pki@mgmt01
            '');
          };
        };
      };

      services.autosshProxy = {
        "mgmt01" = { port = 8129; sshpassSecret = "root@mgmt01.mathinst.loc"; };
        "mathw0e" = { port = 8125; sshpassSecret = "gkleen@mathw0e.mathinst.loc"; };
        "mathw0h" = { port = 8123; sshpassSecret = "gkleen@mathw0h.mathinst.loc"; };
        "cip04" = { port = 8127; sshpassSecret = "gkleen@cip04.cipmath.loc"; };
        "ssh.math.lmu.de" = { port = 8119; sshpassSecret = "gkleen@ssh.math.lmu.de"; };
      };

      home.file = {
        ".cups/client.conf".text = ''
          ServerName cups.mathinst.loc
        '';
      };

      home.packages = with pkgs; [
        cups
      ];
    };
  };
}