{ customUtils, flake, config, lib, pkgs, ... }:

with lib;

let
  disallowedSystems = ["armv5tel-linux" config.nixpkgs.system] ++ optional (systems.elaborate config.nixpkgs.system).isx86_64 "i686-linux";
in {
  imports = with flake.nixosModules.systemProfiles; [ openssh ];

  config = {
    users.groups.nix-ssh-builder = {};
    users.users.nix-ssh-builder = {
      description = "Nix build server user";
      useDefaultShell = true;
      isSystemUser = true;
      group = "nix-ssh-builder";
      extraGroups = [ "ssh" ];
    };
    nix.settings.trusted-users = [ "nix-ssh-builder" ];

    services.openssh = {
      enable = true;
      extraConfig = ''
        Match User nix-ssh-builder
          AllowAgentForwarding no
          AllowTcpForwarding no
          PermitTTY no
          PermitTunnel no
          X11Forwarding no
          ForceCommand ${config.nix.package.out}/bin/nix-store --serve --write
        Match All
      '';
    };

    users.users.nix-ssh-builder.openssh.authorizedKeys.keys =
      let
        importKeys = dir: attrValues (customUtils.mapFilterAttrs (_: v: v != null) (n: v: nameValuePair n (if v == "directory" then importKeys' dir n else null)) (builtins.readDir dir));
        importKeys' = dir: host: builtins.readFile (dir + "/${host}/public");
      in importKeys ./clients;

    boot.binfmt.emulatedSystems = mkDefault (filter (system: (systems.elaborate system).emulatorAvailable pkgs && !(elem system disallowedSystems)) systems.flakeExposed);
  };
}