{ inputs, lib, pkgs, ... }:
{
  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];

  environment.systemPackages = [
    pkgs.vim
    pkgs.git
    pkgs.agenix
    pkgs.podman
    pkgs.python3
    pkgs.podman-compose
    (pkgs.writeShellScriptBin "panelctl" (builtins.readFile ./panel/panelctl.sh))
  ];

  virtualisation.podman = {
    enable = true;
    dockerCompat = true;
    defaultNetwork.settings.dns_enabled = true;
  };

  users.groups.panelroutes = { };

  users.users.reudy = {
    isNormalUser = true;
    # Keep home traversable so caddy can import generated snippets from ~/containers/routes.
    homeMode = "0755";
    extraGroups = [ "wheel" "podman" "panelroutes" ]; #sudo
    openssh.authorizedKeys.keys = [
      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6TOSFZ+P0oWTa9U3fX/L9c3btv/lCgzPrwKu621aLDjSbWbaddGhAXQtJvl7GJvs7QN52z+icftK94gdeyTbZyzQtY6JNUVmUs5EHlZlYTkAYSFN/rkn6N7/n9aYRN+vd8r0B4IrP5gTPtGglLD16dfukpOgwtQj/eK6tqZpVlZ7LnKK7UaA6a4OXMYgJZAwdzAOfFGfbO++5q+igBdfNJmh5LtYMI6te8AlJGBSVierzeStEzTVbIys1EsyNrEMzAljHBxxco2L7enNmz4xciRNCQ/za5xPmhf8nOoZTIalBziM52DGH6rFzUEBVsqez1U2U4ajVzdSIudOlku4w63YnClHeGNu9AdHJjR7PbIHwui17aGKM/l/Qv/LOWWo+nfO1hbCl0fGZwVkl8p4yR3WM73OWEHn1f+Uc4cWAUDZ/ZDPE0qyA/HAnSA6dfzY66y2evjRBeekA4zcxgmc7Q/2XfKHDYMEKTNkgdO6UAFoUqW4BiyF36FcS1ccjUok= root@DESKTOP-40EVMS3"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhbz4AlnRrRNvUwlYd5siMTuvgvSwlJ21Tq54OA20ID reudy@DESKTOP-40EVMS3"
      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD0mitcnuzNWof+RbTIoxDaXonU6yk+i6kpA4lIdI5fE6fzLCOGia5q4t1qen7Lhj1RMuJRqg5R8GeYmAW3tx2Uo3mqnQLJY227xs2FJU5ygn8JW1Uivp6sCJO5yzCHv8JYy9ala+eHlmppmjBo+NnU2mNlPfM5pNKef/srz5jmkeD+73rUim/1KSCZ3yOzSzc1jf7vNkxXAgDREzbmX/sqIrhG2DxjGAaX6SJjh0lh9OF6m1lAkEGq39h3WS7UKAsP3Z2OOSfEKwAefYvijIoWpL5+XGas3p7mhBG9ZDATJVcUHD/tg7XC4QOU8rYTjuP2/ECFS37q4+OCCJlyBRY46AS4ohKDs9iF8z9IjI3G2P6nTOeIySL84kKGI3ufcvBtUpITKWF4rwLE2R4WVG3SOMSCizFJZtpijVOJJulJUYwIyx0khSGpg3cL2LePyJn23FMlaG6w03H0ngdckGxLuvd+H0D12YVa0990hYaquzXPfMsSUy5T9ZievsVu6jU= reudy@Reudy"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKwpcTESCEAiQ+/c8bM9Y2b53nCCl3qFI5KRuEkR+Ya jacob@DESKTOP-40EVMS3"
    ];
  };

  users.users.caddy.extraGroups = [ "panelroutes" ];

  systemd.tmpfiles.rules = [
    "d /home/reudy/containers 0750 reudy panelroutes -"
    "d /home/reudy/containers/stacks 0750 reudy panelroutes -"
    "d /home/reudy/containers/volumes 0750 reudy panelroutes -"
    "d /home/reudy/containers/routes 0755 reudy panelroutes -"
    "d /home/reudy/containers/state 0750 reudy panelroutes -"
    "d /home/reudy/containers/state/apps 0750 reudy panelroutes -"
    "f /home/reudy/containers/routes/_placeholder.caddy 0640 reudy panelroutes -"
    "f /var/lib/systemd/linger/reudy"
  ];

  systemd.services.panel-api = {
    description = "Minimal panel API service";
    after = [ "network.target" ];
    wantedBy = [ "multi-user.target" ];
    path = [
      pkgs.podman
      pkgs.podman-compose
      pkgs.sudo
      pkgs.coreutils
    ];

    serviceConfig = {
      Type = "simple";
      User = "reudy";
      Group = "panelroutes";
      Restart = "always";
      RestartSec = 3;
      WorkingDirectory = "/home/reudy";
      ExecStart = "${pkgs.python3}/bin/python3 ${./panel/panel-api.py}";
    };

    environment = {
      PANEL_API_BIND = "127.0.0.1";
      PANEL_API_PORT = "9911";
      PANEL_BASE_DIR = "/home/reudy/containers";
      PANELCTL_PATH = "/run/current-system/sw/bin/panelctl";
    };
  };

  security.sudo.wheelNeedsPassword = true;
  security.sudo.extraRules = [
    {
      users = [ "reudy" ];
      commands = [
        {
          command = "${pkgs.systemd}/bin/systemctl reload caddy";
          options = [ "NOPASSWD" ];
        }
      ];
    }
  ];


  services.openssh = {
    enable = true;

    # Allow root login with password, needed for passwords set through vpsAdmin
    settings = {
      PermitRootLogin = "no";
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;
      X11Forwarding = false;
      AllowUsers = [ "reudy" ];
    };

    ports = [ 14902 ];

    # Needed for public keys deployed through vpsAdmin, can be disabled if you
    # authorize your keys in configuration
    authorizedKeysInHomedir = true;
  };

  # fail2ban
  services.fail2ban = {
    enable = true;
    maxretry = 5;
    bantime = "24h";
    bantime-increment = {
      enable = true;
      multipliers = "1 2 4 8 16 32 64";
      maxtime = "168h";
      overalljails = true;
    };
    jails.sshd.settings = {
      enabled = true;
      port = "14902";
      maxretry = 3;
      findtime = "10m";
      bantime = "1h";
    };
  };
  
  # Networking
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [ 80 443 14902 ]; # http https ssh
  };

  systemd.settings.Manager = {
    DefaultTimeoutStartSec = "900s";
  };

  time.timeZone = "Europe/Amsterdam";

  system.stateVersion = "25.11";
}