{ config, lib, pkgs, ... }:
{
  imports = [ ../common.nix ./hardware-configuration.nix ];
  boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ];
  users.users.bogale.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1"
  ];
  networking = {
    hostName = "nixos-server";
    networkmanager.ensureProfiles.profiles.home-wifi = {
      wifi.ssid = "bogale_2.4";
      wifi-security.psk = builtins.readFile "/root/secrets/home-wifi.psk";
    };
    firewall = {
      allowedTCPPorts = [ 80 ];
      extraInputRules = ''
        ip saddr 192.168.1.0/24 tcp dport 22 accept
      '';
    };
  };
  #environment.systemPackages = with pkgs; [
    #php
  #];
  services = {
    postgresql.enable = true;
    openssh = {
      enable = true;
      openFirewall = false;
      settings = {
        PermitRootLogin = "no";
        PasswordAuthentication = false;
      };
    };
    phpfpm.pools.main = {
      user = "nginx";
      group = "nginx";
      settings = {
        "pm" = "ondemand";
        "pm.max_children" = 8;
        "listen.owner" = "nginx";
        "listen.group" = "nginx";
      };
    };
    nginx = {
      enable = true;
      recommendedTlsSettings = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedBrotliSettings = true;
      virtualHosts."_" = {
        default = true;
        root = "/srv/http/_";
        locations."~ \\.php$".extraConfig = ''
          fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
        '';
      };
    };
    vaultwarden = {
      enable = true;
      configureNginx = true;
      dbBackend = "postgresql";
      configurePostgres = true;
      package = pkgs.vaultwarden-postgresql;
      domain = "https://wg.bogaledev.ru/vault";
      environmentFile = "/root/secrets/vaultwarden.env";
      config = {
        EMAIL_TOKEN_SIZE = 8;
        SMTP_SECURITY = "off";
        SMTP_HOST = "localhost";
        SIGNUPS_ALLOWED = false;
        REQUIRE_DEVICE_EMAIL = true;
        TRASH_AUTO_DELETE_DAYS = 90;
        ROCKET_ADDRESS = "127.0.0.1";
        PASSWORD_HINTS_ALLOWED = false;
        EMERGENCY_ACCESS_ALLOWED = false;
        SMTP_FROM = "vaultwarden@bogaledev.ru";
      };
    };
  };
}