{ config, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./ullr/hw.nix
      ./nixpkgs.nix
      ./users.nix
      ./utils/nix/module.nix
    ];

  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;
  boot.loader.grub.version = 2;
  boot.loader.grub.device = "/dev/sda";

  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
  # Per-interface useDHCP will be mandatory in the future, so this generated config
  # replicates the default behaviour.
  networking = {
    domain = "yggdrasil.li";
    hostName = "ullr";

    useDHCP = false;
    enableIPv6 = true;

    firewall = {
      enable = true;
      allowPing = true;
      allowedTCPPorts = [ 22 # ssh
                          64738 # murmur
                        ];
      allowedUDPPorts = [ 64738 # murmur
                        ];
      allowedUDPPortRanges = [ { from = 60000; to = 61000; } # mosh
                             ];
    };

    interfaces.ens3 = {
      useDHCP = true;
      ipv6.addresses = [
        { address = "2a03:4000:15:93d::";
          prefixLength = 64;
        }
      ];
    };
  };

  # Set your time zone.
  time.timeZone = "Europe/Berlin";

  environment.systemPackages = with pkgs; [
    git mosh rsync tmux zsh
    rebuild-system
  ];

  users.extraUsers.root = let
    template = (import users/gkleen.nix);
    in {
        inherit (template) shell;
        openssh.authorizedKeys.keyFiles = template.openssh.authorizedKeys.keyFiles;
      };

  # Enable the OpenSSH daemon.
  services.openssh = {
    enable = true;
    passwordAuthentication = false;
    challengeResponseAuthentication = false;
    extraConfig = ''
      AllowGroups ssh
    '';
  };
  users.groups."ssh" = {
    members = ["root"];
  };

  services.factorio = {
    enable = true;
    package = pkgs.factorio-headless-experimental;
    autosave-interval = 10;
    game-name = "Ullr";
    public = true;
    username = "ndxsbvrt";
    token = builtins.readFile /etc/factorio-token;
    extraSettings = {
      admins = ["ndxsbvrt" "BoeseMilch"];
      only_admins_can_pause_the_game = false;
    };
    whitelist = ["ndxsbvrt" "BoeseMilch"];
    dynamicMods = true;
  };
  users.groups."games" = {};
  nixpkgs.config.allowUnfree = true;

  services.murmur = {
    enable = true;
    bandwidth = 288000;
    sslKey = "/var/lib/acme/yggdrasil.li/key.pem";
    sslCert = "/var/lib/acme/yggdrasil.li/fullchain.pem";
    password = builtins.readFile /etc/murmur-password;
  };
  users.groups."ssl" = {
    members = [ "murmur" ];
  };

  security.acme = {
    acceptTerms = true;
    certs."ullr.yggdrasil.li" = {
      allowKeysForGroup = true;
      group = "ssl";
    };
  };

  services.nginx.enable = true;
  services.nginx.virtualHosts."ullr.yggdrasil.li" = {
    default = true;
    addSSL = true;
    enableACME = true;
    root = "/var/www/";
    locations."/".return = "404";
    useACMEHost= "ullr.yggdrasil.li";
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "20.09";
}