{ config, pkgs, ... }:

let
  luaPam = pkgs.callPackage ./custom/luaPam.nix {};
  luaPosix = pkgs.callPackage ./custom/luaPosix.nix {};
  luaSha2 = pkgs.callPackage ./custom/luaSha2.nix {};
  prosodyAuth = pkgs.callPackage ./custom/prosody-auth.nix {};
  prosodyVirtHost = name: {
    enabled = true;
    domain = name;
    ssl = {
      key = "certs/${name}.key";
      cert = "certs/${name}.crt";
    };
  };
in rec {
  imports =
    [
      ./ymir-hw.nix
      ./custom/zsh.nix
      ./users.nix
      ./custom/tinc/def.nix
    ];

  boot.loader.grub = {
    enable = true;
    version = 2;
    device = "/dev/vda";
  };

  boot.kernel.sysctl = {
    "net.ipv4.tcp_keepalive_time" = 60;
    "net.ipv4.tcp_keepalive_intvl" = 10;
    "net.ipv4.tcp_keepalive_probes" = 6;
  };

  nixpkgs.config.packageOverrides = pkgs:
    rec {
      prosody = pkgs.callPackage ./customized/prosody.nix ({
          inherit (pkgs.lua51Packages) luasocket luasec luaexpat luafilesystem luabitop luaevent luazlib;
          lua5 = pkgs.lua5_1;
          communityModules = ["mod_carbons"];
          extraModules = [prosodyAuth];
          extraLibs = [luaPam luaPosix luaSha2];
        });
    };

  environment.systemPackages = with pkgs; [
    git
    mosh
    rsync
    tmux
    zsh
  ];

  networking = {
    hostName = "ymir";
    hostId = "1c5c994e";
    firewall = {
      enable = true;
      allowPing = true;
      allowedTCPPorts = [ 22 # ssh
                          5222 # xmpp.s2c
                          5269 # xmpp.s2s
                          655 # tinc.yggdrasil
                          656 # tinc.laeradhr
                          80 # http
                          443 # https
                          9418 # git
                        ];
      allowedUDPPortRanges = [ { from = 60000; to = 61000; } # mosh
                             ];
    };
    enableIPv6 = true;
    defaultGateway6 = "fe80::1";
    interfaces."enp0s3" = {
      ipv6Address = "2a03:4000:6:d004::";
      ipv6PrefixLength = 64;
    };
  };

  users.extraUsers.root = let
    template = (import users/gkleen.nix);
    in {
        inherit (template) shell;
        openssh.authorizedKeys.keyFiles = template.openssh.authorizedKeys.keyFiles;
      };

  services.ntp = {
    enable = false;
  };

  nix.binaryCaches = [ "https://cache.nixos.org/"
                     ];
  nix.binaryCachePublicKeys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
                              ];

  # List services that you want to enable:

  services.openssh = {
    enable = true;
    passwordAuthentication = false;
  };

  services.fcron = {
    enable = true;
    systab = ''
      %weekly * * nix-collect-garbage --delete-older-than '7d'
    '';
  };

  services.chrony = {
    enable = true;
  };

  services.prosody = {
    enable = true;
    admins = [
               "gkleen@xmpp.li"
             ];
    allowRegistration = false;
    extraModules = [ "private"
                     "auth_custom"
                     "carbons"
                   ];
    extraConfig = ''
      authentication="custom"
      custom_alias_file="/etc/prosody/aliases"
      custom_alias_secret_file="/etc/prosody/alias_secret"

      Component "alias.xmpp.li"
        Include "/etc/prosody/alias.xmpp.li.cfg.lua"
    '';

    virtualHosts = builtins.listToAttrs (map (name: { inherit name; value = prosodyVirtHost name; })
      ["xmpp.li" "yggdrasil.li" "praseodym.org" "141.li"]);
  };
  security.pam.services."xmpp".text = ''
    auth requisite  pam_succeed_if.so user ingroup xmpp
    auth required   pam_unix.so audit
  '';
  users.groups."shadow" = {
    members = [ "prosody"
              ];
  };
  users.groups."xmpp" = {};
  system.activationScripts."shadow-perms" = ''
    chown root:shadow /etc/shadow
    chmod 0640 /etc/shadow
  '';

  services.customTinc.networks = ((import ./custom/tinc/yggdrasil.nix) {
    inherit (pkgs) stdenv nettools openresolv;
    name = "ymir";
    connect = false;
    ipConf = {
      ip4 = [ { address = "10.141.5.1"; prefixLength = 16; } ];
    };
    })
    // ((import ./custom/tinc/laeradhr.nix) {
     inherit (pkgs) stdenv nettools openresolv;
    name = "ymir";
    connect = false;
    ipConf = {
      ip4 = [ { address = "10.142.0.3"; prefixLength = 16; } ];
    };
    });

  services.nginx = {
    enable = true;
    httpConfig = builtins.readFile ./custom/ymir.nginx;
  };

  services.gitolite = {
    enable = true;
    adminPubkey = builtins.readFile (builtins.head (import ./users/gkleen.nix).openssh.authorizedKeys.keyFiles);
    dataDir = "/srv/git";
  };
  users.extraUsers."gitolite" = {
    group = "git";
  };

  services.gitDaemon = {
    enable = true;
    basePath = services.gitolite.dataDir + "/repositories";
  };

  containers.letsencrypt = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = "192.168.0.1";
    localAddress = "192.168.0.2";
    config = {
      services.fcron = {
        enable = true;
        systab = ''
          @ 60d ${pkgs.findutils}/bin/xargs -d '\n' -I '{}' -- ${pkgs.letsencrypt}/bin/letsencrypt auth --standalone --renew-by-default --agree-dev-preview --agree-tos --rsa-key-size=4096 --text --email=webmaster@yggdrasil.li -d '{}' </etc/letsencrypt/domains 2>&1 | ${pkgs.eject}/bin/logger -p cron.notice 
        '';
      };
    };
  };

  networking.nat = {
    enable = true;
    externalInterface = "enp0s3";
    internalInterfaces = [ "ve-letsencrypt"
                         ];
  };
}