{ customUtils, lib, config, hostName, pkgs, ... }:

with lib;

let
  cfg = config.services.openssh;
in {
  options = {
    services.openssh.staticHostKeys = mkOption {
      type = types.bool;
      default = pathExists (./host-keys + "/${hostName}.yaml");
    };
  };

  config = {
    systemd.user.services."ssh-agent".enable = mkForce false; # ssh-agent should be done via home-manager

    services.openssh = mkIf cfg.enable {
      hostKeys = mkIf cfg.staticHostKeys (mkForce []); # done manually
      settings = {
        Ciphers = [
          "chacha20-poly1305@openssh.com"
          "aes256-gcm@openssh.com"
          "aes256-ctr"
        ];
        Macs = [
          "hmac-sha2-256-etm@openssh.com"
          "hmac-sha2-256"
          "hmac-sha2-512-etm@openssh.com"
          "hmac-sha2-512"
        ];
        KexAlgorithms = [
          "sntrup761x25519-sha512@openssh.com"
          "curve25519-sha256"
          "curve25519-sha256@libssh.org"
          "diffie-hellman-group-exchange-sha256"
        ];
        HostKeyAlgorithms = concatStringsSep "," [
          "sk-ssh-ed25519-cert-v01@openssh.com"
          "ssh-ed25519-cert-v01@openssh.com"
          "rsa-sha2-256-cert-v01@openssh.com"
          "rsa-sha2-512-cert-v01@openssh.com"
          "sk-ssh-ed25519@openssh.com"
          "ssh-ed25519"
          "rsa-sha2-256"
          "rsa-sha2-512"
        ];
        CASignatureAlgorithms = concatStringsSep "," [
          "sk-ssh-ed25519@openssh.com"
          "ssh-ed25519"
          "rsa-sha2-256"
          "rsa-sha2-512"
        ];

        LogLevel = "VERBOSE";
        RevokedKeys = "/etc/ssh/krl.bin";

        PasswordAuthentication = mkDefault false;
        KbdInteractiveAuthentication = mkDefault false;
      };
      moduliFile = mkIf (config.sops.secrets ? "ssh_moduli") config.sops.secrets.ssh_moduli.path;
      extraConfig = ''
        ${optionalString cfg.staticHostKeys "HostKey /etc/ssh/ssh_host_ed25519_key"}
        ${optionalString (config.environment.etc ? "ssh/ssh_host_ed25519_key-cert.pub") "HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub"}
        ${optionalString cfg.staticHostKeys "HostKey /etc/ssh/ssh_host_rsa_key"}
        ${optionalString (config.environment.etc ? "ssh/ssh_host_rsa_key-cert.pub") "HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub"}
      '';
    };

    programs.ssh = {
      knownHosts = {
        "*.yggdrasil.li" = {
          extraHostNames = ["*.yggdrasil"];
          certAuthority = true;
          publicKeyFile = ./ca/ca.pub;
        };
      };
      knownHostsFiles = [
        ./known-hosts/borgbase.keys
      ];

      ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ];
      hostKeyAlgorithms = [ "sk-ssh-ed25519-cert-v01@openssh.com" "ssh-ed25519-cert-v01@openssh.com" "rsa-sha2-256-cert-v01@openssh.com" "rsa-sha2-512-cert-v01@openssh.com" "sk-ssh-ed25519@openssh.com" "ssh-ed25519" "rsa-sha2-256" "rsa-sha2-512" ];
      kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
      macs = [ "umac-128-etm@openssh.com" "hmac-sha2-256-etm@openssh.com" "hmac-sha2-512-etm@openssh.com" "umac-128@openssh.com" "hmac-sha2-256" "hmac-sha2-512" "umac-64-etm@openssh.com" "umac-64@openssh.com"];
      pubkeyAcceptedKeyTypes = [ "ssh-ed25519-cert-v01@openssh.com" "sk-ssh-ed25519-cert-v01@openssh.com" "rsa-sha2-512-cert-v01@openssh.com" "rsa-sha2-256-cert-v01@openssh.com" "ssh-ed25519" "ssh-rsa" ];
      extraConfig = ''
        Host *
          CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512
          PasswordAuthentication no
          KbdInteractiveAuthentication no
      '';
    };

    sops.secrets = mkIf cfg.enable {
      ssh_host_rsa_key = mkIf cfg.staticHostKeys {
        key = "rsa";
        path = "/etc/ssh/ssh_host_rsa_key";
        sopsFile = ./host-keys + "/${hostName}.yaml";
      };
      ssh_host_ed25519_key = mkIf cfg.staticHostKeys {
        key = "ed25519";
        path = "/etc/ssh/ssh_host_ed25519_key";
        sopsFile = ./host-keys + "/${hostName}.yaml";
      };
      ssh_moduli = mkIf (pathExists (./host-moduli + "/${hostName}")) {
        format = "binary";
        path = "/etc/ssh/moduli";
        sopsFile = ./host-moduli + "/${hostName}";
      };
    };

    environment.etc = mkIf cfg.enable {
      "ssh/ssh_host_rsa_key.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/rsa.pub"; };
      "ssh/ssh_host_ed25519_key.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/ed25519.pub"; };

      "ssh/ssh_host_rsa_key-cert.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/rsa-cert.pub"; };
      "ssh/ssh_host_ed25519_key-cert.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/ed25519-cert.pub"; };

      "ssh/krl.bin".source = ./ca/krl.bin;
    };

    environment.systemPackages = mkIf cfg.enable (with pkgs; [
      alacritty.terminfo
    ]);
  };
}