# sudo nixos-rebuild switch --flake .#builder --target-host root@192.168.3.118
# or
# deploy .#builder
{
  pwd,
  config,
  inputs,
  outputs,
  ...
}: {
  imports =
    [
      inputs.disko.nixosModules.disko

      ./disko.nix
      ./hardware-configuration.nix

      "${pwd}/features-nixos/global/fish.nix" # fish for admin
      "${pwd}/features-nixos/global/locale.nix"
      "${pwd}/features-nixos/global/nix.nix"
      "${pwd}/features-nixos/global/sops.nix"
      "${pwd}/features-nixos/global/root.nix"

      # "${pwd}/features-nixos/optional/hydra.nix"
      # "${pwd}/features-nixos/optional/jenkins-agent.nix"
    ]
    ++ (builtins.attrValues outputs.nixosModules);

  frajul.gitlab-runner = {
    enable = false;
    secretsFile = ./secrets.yaml;
  };
  frajul.gitea-runner = {
    enable = false;
    secretsFile = ./secrets.yaml;
  };

  networking.hostName = "builder";
  system.stateVersion = "23.11";

  networking.networkmanager.enable = true;
  networking.nameservers = [
    "192.168.3.252"
    "172.30.20.10"
    "1.1.1.1"
  ];

  users.mutableUsers = false;
  users.users.nix = {
    isNormalUser = true;
    description = "Nix";
    extraGroups = [
      "networkmanager"
      "wheel"
      "docker"
    ];
  };

  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];

  # Setup binary caches
  nix.settings = {
    substituters = [
      "https://nix-community.cachix.org"
      "https://cache.nixos.org/"
      "https://hyprland.cachix.org"
      "https://devenv.cachix.org"
    ];
    trusted-public-keys = [
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
      "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
      "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
    ];

    trusted-users = ["nix"];
    max-jobs = "auto";
    cores = 0;

    # Ensure we can still build when missing-server is not accessible
    fallback = true;
  };

  system.autoUpgrade = {
    enable = true;
    flake = "git+https://gitlab.julian-mutter.de/julian/dotfiles";
    flags = [
      "--recreate-lock-file" # update lock file
    ];
    dates = "02:13";
  };

  # optimize store by hardlinking store files
  nix.optimise.automatic = true;
  nix.optimise.dates = ["03:15"];

  nix.gc.automatic = true;
  nix.gc.dates = "daily";
  nix.gc.options = "--delete-old";

  # nix.settings.keep-derivations = false;
  # nix.settings.keep-outputs = true;

  # Garbage collect up to 100 GiB when only 20 GiB storage left
  nix.extraOptions = ''
    min-free = ${toString (20 * 1024 * 1024 * 1024)}
    max-free = ${toString (100 * 1024 * 1024 * 1024)}
  '';

  nix.nrBuildUsers = 64;

  # prevent memory to get filled
  systemd.services.nix-daemon.serviceConfig = {
    MemoryAccounting = true;
    MemoryMax = "90%";
    OOMScoreAdjust = 500;
  };

  services.openssh = {
    enable = true;
    # require public key authentication for better security
    settings.PasswordAuthentication = false;
    settings.KbdInteractiveAuthentication = false;
    settings.PermitRootLogin = "yes";
  };
  users.users."root".openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFjSZYdoF/51F+ykcBAYVCzCPTF5EEigWBL1APiR0h+H julian@aspi"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFcS+3d1tNgHmYCjueymCV9Bd2LcJcKGhVobrDe3r0s julian@kardorf"
  ];
  users.users."nix".openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFjSZYdoF/51F+ykcBAYVCzCPTF5EEigWBL1APiR0h+H julian@aspi"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAIQ+qMuXvyoxO1DuCR3/x+IQRfSA2WyMuzuotWZjCye root@aspi"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHnfLJnS2SKUs47J0qpLTkk0LQA5quOuAhnxE6yppUDm root@kardorf"
  ];

  # security.pam.sshAgentAuth.enable = true; # enable sudo via ssh

  # add builder itpwd as build machine so system emulation is properly supported
  # nix.distributedBuilds = true;
  nix.buildMachines = [
    {
      hostName = "localhost";
      protocol = null;
      # sshUser = "nix";
      systems = [
        "x86_64-linux"
        "aarch64-linux"
      ];
      maxJobs = 4;
      speedFactor = 3;
      supportedFeatures = [
        "nixos-test"
        "benchmark"
        "big-parallel"
        "kvm"
      ];
    }
  ];

  networking.firewall.allowedTCPPorts = [
    80
  ];
  services.nginx = {
    enable = true;
    recommendedProxySettings = true;

    # nix-serve
    virtualHosts."binarycache.julian-mutter.de" = {
      locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
    };

    # attic
    clientMaxBodySize = "2G";
    virtualHosts."cache.julian-mutter.de" = {
      locations."/".proxyPass = "http://127.0.0.1:8080";
    };
  };

  # =========== Binary Cache ==========
  services.nix-serve = {
    enable = true;
    secretKeyFile = "/var/cache-priv-key.pem";
  };

  # =========== Binary Cache with attic ==========
  sops.secrets."attic_token".sopsFile = ./secrets.yaml;

  services.atticd = {
    enable = true;
    environmentFile = config.sops.secrets."attic_token".path;
    settings = {
      listen = "[::]:8080";

      jwt = {};

      # Data chunking
      #
      # Warning: If you change any of the values here, it will be
      # difficult to reuse existing chunks for newly-uploaded NARs
      # since the cutpoints will be different. As a result, the
      # deduplication ratio will suffer for a while after the change.
      chunking = {
        # The minimum NAR size to trigger chunking
        #
        # If 0, chunking is disabled entirely for newly-uploaded NARs.
        # If 1, all NARs are chunked.
        nar-size-threshold = 64 * 1024; # 64 KiB

        # The preferred minimum size of a chunk, in bytes
        min-size = 16 * 1024; # 16 KiB

        # The preferred average size of a chunk, in bytes
        avg-size = 64 * 1024; # 64 KiB

        # The preferred maximum size of a chunk, in bytes
        max-size = 256 * 1024; # 256 KiB
      };
    };
  };
}