# Setup the device as a jenkins agent
{pkgs, ...}: {
  services.openssh = {
    enable = true;
    # require public key authentication for better security
    settings.PasswordAuthentication = false;
    settings.KbdInteractiveAuthentication = false;
    settings.PermitRootLogin = "yes";
    # Add older algorithms for jenkins ssh-agents-plugin to be compatible
    settings.Macs = [
      "hmac-sha2-512-etm@openssh.com"
      "hmac-sha2-256-etm@openssh.com"
      "umac-128-etm@openssh.com"
      "hmac-sha2-512"
      "hmac-sha2-256"
      "umac-128@openssh.com"
    ];
    settings.KexAlgorithms = [
      "diffie-hellman-group-exchange-sha1"
      "diffie-hellman-group14-sha1"
      "mlkem768x25519-sha256"
      "sntrup761x25519-sha512"
      "sntrup761x25519-sha512@openssh.com"
      "curve25519-sha256"
      "curve25519-sha256@libssh.org"
      "diffie-hellman-group-exchange-sha256"
    ];
  };

  users.users.jenkins = {
    createHome = true;
    home = "/var/lib/jenkins";
    group = "jenkins";
    isNormalUser = true;
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ36sQhVz3kUEi8754G7r3rboihhG4iqFK/UvQm6SING jenkins@home"
    ];
    packages = with pkgs; [
      git
      devenv
    ];
    extraGroups = [
      "docker"
    ];
  };

  users.groups.jenkins = {};
  programs.java = {
    enable = true;
    package = pkgs.jdk21; # Same as jenkins version on home
  };
}