{ flake, config, ... }:

{
  config = {
    boot.enableContainers = true;
    boot.kernel.sysctl = {
      "net.netfilter.nf_log_all_netns" = true;
    };
    systemd.network = {
      networks."80-container-ve".enable = false;
      links."80-container-ve".enable = false;
    };

    containers."kimai" = {
      autoStart = true;
      ephemeral = true;
      bindMounts = {
        "/var/lib/kimai" = {
          hostPath = "/var/lib/kimai/state";
          isReadOnly = false;
        };
        "/var/lib/mysql" = {
          hostPath = "/var/lib/kimai/mysql";
          isReadOnly = false;
        };
      };
      privateNetwork = true;
      # forwardPorts = [
      #   { containerPort = 80;
      #     hostPort = 28983;
      #   }
      # ];
      hostAddress = "192.168.52.113";
      localAddress = "192.168.52.114";
      hostAddress6 = "2a03:4000:52:ada:6::1";
      localAddress6 = "2a03:4000:52:ada:6::2";
      config = let hostConfig = config; in { config, pkgs, lib, ... }: {
        system.stateVersion = lib.mkIf hostConfig.containers."kimai".ephemeral config.system.nixos.release;
        system.configurationRevision = lib.mkIf (flake ? rev) flake.rev;
        nixpkgs.pkgs = hostConfig.nixpkgs.pkgs;

        services.kimai.sites."kimai.yggdrasil.li" = {
          database.socket = "/run/mysqld/mysqld.sock";
        };

        networking = {
          useDHCP = false;
          useNetworkd = true;
          useHostResolvConf = false;
          firewall.enable = false;
          nftables = {
            enable = true;
            rulesetFile = ./ruleset.nft;
          };

          interfaces.eth0 = {
            ipv4.routes = [
              { address = "192.168.52.113"; prefixLength = 24; }
              { address = "0.0.0.0"; prefixLength = 0; via = "192.168.52.113"; }
            ];
            ipv6.routes = [
              { address = "2a03:4000:52:ada:6::1"; prefixLength = 128; }
              { address = "::"; prefixLength = 0; via = "2a03:4000:52:ada:6::1"; }
            ];
          };
        };

        services.resolved.settings.Resolve.FallbackDns = [
          "9.9.9.10#dns10.quad9.net"
          "149.112.112.10#dns10.quad9.net"
          "2620:fe::10#dns10.quad9.net"
          "2620:fe::fe:10#dns10.quad9.net"
        ];

        systemd.network = {
          networks."40-eth0" = {
            linkConfig = {
              RequiredForOnline = true;
            };
            networkConfig = {
              LLMNR = false;
              MulticastDNS = false;
            };
          };
        };
      };
    };
  };
}