{ config, lib, pkgs, ... }:
{
  services.openssh = {
    enable = true;
    settings.PasswordAuthentication = false;
  };
  systemd = {
    tmpfiles.rules = [
      "d /var/spool/postfix 0755 postfix postfix -"
      "d /var/spool/postfix/private 0755 postfix postfix -"
    ];
    timers = {
      tgbot-send = {
        wantedBy = [ "timers.target" ];
        timerConfig = {
          OnCalendar = "*-*-01 16:00:00";
          Persistent = true;
        };
      };
      network-watchdog = {
        wantedBy = [ "timers.target" ];
        timerConfig = {
          OnBootSec = 30;
          AccuracySec = 1;
          OnUnitActiveSec = 10;
        };
      };
    };
    services = {
      tgbot-send = {
        serviceConfig.Type = "oneshot";
        script = ''
          . /secrets/tgbot.env
          ${pkgs.curl}/bin/curl "https://api.telegram.org/$BOT/sendMessage" \
            -X POST -d "chat_id=$CHAT_ID" -d "text=$TEXT" 2> /dev/null | \
            ${pkgs.jq}/bin/jq '.result.date |= strftime("%Y-%m-%d %H:%M:%S")'
        '';
      };
      network-watchdog = {
        serviceConfig = {
          Type = "oneshot";
          LogLevelMax = "notice";
        };
        script = ''
          if [ ! -e /run/network.failures ] || \
            ${pkgs.iputils}/bin/ping -c 1 -W 3 1.1.1.1 &> /dev/null; then
            failures=0
          else
            failures=$((1+$(cat /run/network.failures)))
          fi
          if [ $failures -gt 0 ]; then
            echo "<5>failures = $failures"
          fi
          if [ $failures -ge 3 ]; then
            echo "<4>restarting NetworkManager"
            systemctl restart NetworkManager.service
            failures=0
          fi
          echo $failures > /run/network.failures
        '';
      };
    };
  };
}