# Server stack shared by dogma-nixos and dogma-nixos-rtx (not WSL)
{
  config,
  lib,
  pkgs,
  inputs,
  ...
}: {
  imports = [
    inputs.configarr.nixosModules.default
  ];

  boot.kernel.sysctl = {
    "net.ipv4.ip_forward" = 1;
    "net.bridge.bridge-nf-call-iptables" = 1;
    "net.ipv4.conf.all.forwarding" = 1;
    "net.ipv6.conf.all.forwarding" = 1;
    "net.ipv4.conf.all.proxy_arp" = 1;
    "net.ipv4.conf.ens2.proxy_arp" = 1;
  };

  networking.firewall.trustedInterfaces = ["br0"];

  # Bridge networking - host-specific NIC may be overridden per-host
  networking.interfaces.enp6s0.useDHCP = false;
  networking.interfaces.br0.useDHCP = true;
  networking.bridges.br0.interfaces = ["enp6s0"];

  services.caddy = {
    enable = true;
    environmentFile = config.sops.templates."caddy.env".path;
    virtualHosts."centraldogma.site:".extraConfig = ''

      root /mnt/games/
      file_server browse
      encode zstd gzip

      redir /radarr /radarr/
      reverse_proxy /radarr/* 127.0.0.1:7878

    '';
    # virtualHosts."dogma.lan:".extraConfig = ''
    #   tls internal
    #   root * /srv/root/
    #   file_server browse
    #   encode zstd gzip
    # '';
    #
    virtualHosts."jellyfin.centraldogma.site:".extraConfig = ''
      reverse_proxy /* 127.0.0.1:8096
    '';

    virtualHosts."sonarr.centraldogma.site:".extraConfig = ''
      redir /sonarr /sonarr/
      reverse_proxy /sonarr/* 127.0.0.1:8989
    '';

    virtualHosts."radarr.centraldogma.site:".extraConfig = ''
      redir /radarr /radarr/
      reverse_proxy /radarr/* 127.0.0.1:7878
    '';
    virtualHosts."git.centraldogma.site:".extraConfig = ''
      reverse_proxy /* 127.0.0.1:3000
    '';
  };

  services.flaresolverr.enable = true;

  services.configarr = {
    enable = true;
  };

  services.mongodb = {
    enable = true;
    package = pkgs.mongodb-ce;
    initialRootPasswordFile = config.sops.secrets."mongodb/initial_password".path;
  };
  services.jackett.enable = true;

  services.factorio = {
    enable = true;
    public = true;
    requireUserVerification = true;
    username = "TheMaskedMan95";
    admins = ["TheMaskedMan95"];
    extraSettingsFile = config.sops.templates."factorio.json".path;
    game-name = "Realm of the Masked Men";
    description = "No Dogs allowed";
    saveName = "SPACExxxx";
    openFirewall = true;
  };

  services.radarr.enable = true;

  services.ddclient = {
    enable = true;
    protocol = "namecheap";
    server = "dynamicdns.park-your-domain.com";
    ssl = true;
    username = "centraldogma.site";
    domains = [
      "@"
      "www"
      "*"
    ];
    usev4 = "webv4, webv4=ipify-ipv4";
    passwordFile = config.sops.secrets."namecheap/ddyn_password".path;
    interval = "5mins";
  };

  services.sonarr.enable = true;

  services.transmission = {
    enable = true;
    openRPCPort = true;
    settings = {
      rpc-bind-address = "0.0.0.0";
      rpc-whitelist = "127.0.0.1,192.168.1.86";
      download-dir = "/mnt/media/Downloads";
    };
  };

  # services.adguardhome = {
  #   enable = true;
  #   host = "0.0.0.0";
  #   port = 3003;
  #   settings = {
  #     allowDHCP = true;
  #     dns = {
  #       upstream_dns = [
  #         "9.9.9.9#dns.quad9.net"
  #         "149.112.112.112#dns.quad9.net"
  #       ];
  #     };
  #     filtering = {
  #       protection_enabled = true;
  #       filtering_enabled = true;
  #       parental_enabled = true;
  #       safe_search.enabled = false;
  #     };
  #     filters =
  #       map (url: {
  #         enabled = true;
  #         url = url;
  #       }) [
  #         "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt"
  #         "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt"
  #       ];
  #   };
  # };
}