{ config, lib, pkgs, ... }:

with lib;

let
  cfg = config.services.yggdrasilTinc;

  heimdallr-up = pkgs.writeScript "heimdallr-up.sh" ''
    #!${pkgs.stdenv.shell}
    ${pkgs.nettools}/bin/route add -net 10.141.1.0 netmask 255.255.255.0 gw 10.141.1.1 dev $INTERFACE metric 9999
    ${optionalString cfg.useDNS ''
      ${pkgs.openresolv}/bin/resolvconf -m 0 -a yggdrasil <<EOF
      domain yggdrasil
      nameserver 10.141.1.1
      EOF
    ''}
  '';

  heimdallr-down = pkgs.writeScript "heimdallr-down.sh" ''
    #!${pkgs.stdenv.shell}
    ${pkgs.nettools}/bin/route del -net 10.141.1.0 netmask 255.255.255.0 gw 10.141.1.1 dev $INTERFACE
    ${optionalString cfg.useDNS ''
      ${pkgs.openresolv}/bin/resolvconf -d yggdrasil
    ''}
  '';
in {
  options = {
    services.yggdrasilTinc = {
      enable = mkEnableOption "yggdrasil tinc network";
      
      connect = mkOption {
        default = true;
        type = types.bool;
        description = ''
          Connect to central server
        '';
      };

      useDNS = mkOption {
        default = true;
        type = types.bool;
        description = ''
          Use heimdallr as primary dns server
        '';
      };

      name = mkOption {
        default = config.networking.hostName;
        type = types.str;
        description = ''
          Node identifier
        '';
      };

      interfaceConfig = mkOption {
        default = {};
        description = ''
          Additional configuration for the generated network interface
        '';
      };
    };
  };

  config = mkIf cfg.enable {
    security.sudo = {
      enable = true;
      extraConfig = ''
        tinc.yggdrasil ${config.networking.hostName} = (root) NOPASSWD: SETENV: ${heimdallr-up}, ${heimdallr-down}
      '';
    };
  
    services.customTinc.networks."yggdrasil" = {
      inherit (cfg) name interfaceConfig;
      debugLevel = 2;
      hosts = import ../../yggdrasil/hosts.nix;
      interfaceType = "tap";
      extraConfig = ''
        Mode = switch
        PingTimeout = 30
        ${optionalString cfg.connect "ConnectTo = ymir"}
      '';
      scripts = {
        "tinc-up" = ''
          #!${pkgs.stdenv.shell}

          set -e
          MACFILE="/var/db/$NETNAME.mac"
          [ -e $MACFILE ] && ${pkgs.iproute}/bin/ip link set dev $INTERFACE address `cat $MACFILE` || cat /sys/class/net/$INTERFACE/address >$MACFILE
        '';
        "hosts/heimdallr-up" = ''
          #!${pkgs.stdenv.shell}

          exec ${config.security.wrapperDir}/sudo -En ${heimdallr-up}
        '';
        "hosts/heimdallr-down" = ''
          #!${pkgs.stdenv.shell}

          exec ${config.security.wrapperDir}/sudo -En ${heimdallr-down}
        '';
      };
    };
  };
}