{ config, lib, pkgs, ... }:
{
  imports = [ ../common.nix ./hardware-configuration.nix
  ./mods/web.nix ./mods/mail.nix ./mods/sysd.nix ];
  boot.kernelParams = [
    "consoleblank=60"
    #TPM fix
    "memmap=0x4000%0xbfb76000-4"
    "memmap=0x4000%0xbfb7a000-4"
  ];
  security.acme = {
    acceptTerms = true;
    defaults.email = "letsencrypt@bogaledev.ru";
    certs."bogaledev.ru" = {
      validMinDays = 3;
      dnsProvider = "cloudflare";
      extraDomainNames = [ "*.bogaledev.ru" ];
      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
    };
  };
  systemd.tmpfiles.rules = [
    "d /root/backup/server 0700 root root -"
    "L /root/backup/server/http - - - - /srv/http"
    "L /root/backup/server/acme - - - - /var/lib/acme"
    "L /root/backup/server/mail - - - - /var/spool/mail"
    "L /root/backup/server/forgejo - - - - /var/lib/forgejo/dump"
    "L /root/backup/server/vaultwarden - - - - /var/lib/vaultwarden"
    "L /root/backup/server/postgresql - - - - /var/backup/postgresql"
  ];
  users = {
    groups = {
      php.gid = 1568;
      vmail.gid = 1819;
    };
    users = {
      nginx.extraGroups = [ "php" "acme" ];
      root.openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow"
      ];
      php = {
        uid = 1568;
        group = "php";
        isSystemUser = true;
      };
      vmail = {
        uid = 1819;
        group = "vmail";
        isSystemUser = true;
      };
    };
  };
  networking = {
    hostName = "nixos-server";
    firewall = {
      allowedUDPPorts = [ 443 ];
      allowedTCPPorts = [ 25 443 465 993 ];
    };
    wg-quick.interfaces.awg0 = {
      configFile = "/secrets/awg/1.conf";
      address = [ "fc00::2/128" "10.0.0.2/32" ];
    };
    networkmanager.ensureProfiles.profiles.wifi = {
      wifi.ssid = "bogale_2.4";
      ipv6.addresses = "fc01::2/64";
      ipv4.addresses = "10.1.0.2/16";
      wifi-security.psk = "$BOGALE_2_4_PSK";
    };
  };
}