{ config, pkgs, ... }:
{
  imports = [
    ./disk-config.nix
    {
      _module.args.disks = [ "/dev/sda" ];
    }

    ../common/servers
  ];

  time.timeZone = "Europe/Berlin";

  networking.hostName = "hosting-02";
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
      80
      443
    ];
    allowedUDPPorts = [
      51820
    ];
  };

  systemd.network.networks."30-wan".address = [
    "2a01:4f8:c013:7fc0::/64"
  ];

  users.groups.vpn = { };
  users.users.vpn = {
    isSystemUser = true;
    group = "vpn";
  };

  networking.iproute2 = {
    enable = true;
    rttablesExtraConfig = ''
      133 vpn
    '';
  };

  systemd.services.vpn-policy-routing =
    let
      vpnUid = toString config.users.users.vpn.uid;
    in
    {
      description = "Apply policy routing rules for the 'vpn' user.";

      wantedBy = [ "multi-user.target" ];

      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];

      serviceConfig.type = "oneshot";

      script = ''
        IP_CMD="${pkgs.iproute2}/bin/ip"
        $IP_CMD rule add from ${builtins.elemAt config.networking.wireguard.interfaces.wg0.ips 0} table vpn prio 200
        $IP_CMD rule add uidrange ${vpnUid}-${vpnUid} table vpn prio 201
        $IP_CMD -6 rule add from ${builtins.elemAt config.networking.wireguard.interfaces.wg0.ips 1} table vpn prio 200
        $IP_CMD -6 rule add uidrange ${vpnUid}-${vpnUid} table vpn prio 201
      '';
    };

  networking.wireguard = {
    enable = true;

    interfaces.wg0 = {
      ips = [
        "10.64.244.95/32"
        "fc00:bbbb:bbbb:bb01::1:f45e/128"
      ];

      peers = [
        {
          publicKey = "KkShcqgwbkX2A9n1hhST6qu+m3ldxdJ2Lx8Eiw6mdXw=";
          allowedIPs = [
            "0.0.0.0/0"
            "::0/0"
          ];
          endpoint = "146.70.117.226:51820";
          persistentKeepalive = 25;
        }
      ];

      listenPort = 51820;
      privateKeyFile = config.sops.secrets.wireguardKey.path;
      table = "133";
    };
  };

  sops.secrets = {
    wireguardKey = {
      owner = "root";
      sopsFile = ./secrets.yaml;
    };
  };

  security.acme.defaults.email = "landervandenbulcke@gmail.com";
  security.acme.acceptTerms = true;

  system.stateVersion = "25.05";
}