{ self, inputs, ... }:
let
  username = "john";
  hostname = "john-pc-ubuntu";

  testHost = "soteria";
  testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f"; # test-nix
  # testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3"; # soteria

in
{
  flake.modules.homeManager."${hostname}" = { config, pkgs, lib, ... }:
  let
    flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
    certDir = "${config.mtls.certDir}";
    mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
    resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";

    testPushCmd = (pkgs.writeShellScriptBin "test-push" ''
      ${lib.getExe' pkgs.coreutils "mkdir"} -p /var/tmp/nix-build
      ${lib.getExe' pkgs.coreutils "chmod"} 1777 /var/tmp/nix-build
      ${lib.getExe pkgs.nixos-rebuild} switch \
        --flake ${flakeDir}#${testHost} \
        --target-host root@${testTarget}
    '');
  in
  {
    imports = with inputs.self.modules.homeManager; [
      rebuild
      john
      mysops
      janus-ca
      step-ssh-user
      mtls
      restic
      docker
      desktop
    ];
    # TODO: make this more restrictive, rather than allowing all unfree packages
    nixpkgs.config.allowUnfree = true;
    nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];

    targets.genericLinux.enable = true;

    home.username = "${username}";
    home.homeDirectory = "/home/${username}";
    home.packages = [
      pkgs.nixos-rebuild
      testPushCmd
    ];

    shell.program = "zsh";
  
    homeManagerFlakeDir = flakeDir;
    docker.enable = true;

    step-ssh-user = {
      enable = true;
      principals = ["root" "${username}" "appdaemon"];
      provisioner = "admin";
    };
    ssh = {
      certificates.enable = true;
      matchSets = {
        certs = true;
        appdaemon = true;
        homelab = true;
        dev = true;
      };
    };

    # This provides the keys at build time and will be included in the nix store
    sops.defaultSopsFile = ../../../keys/secrets.yaml;

    # This will provide the edit-secrets script targeting this file
    mysops.hostSecretFile = "${config.xdg.configHome}/home-manager/jsl-dendritic/keys/secrets.yaml";

    sops.secrets."restic_password" = {
      path = resticPasswordFile;
      mode = "0400";
      sopsFile = ./secrets.yaml;
    };
    restic = {
      passwordFile = resticPasswordFile;
      OnCalendar = "*:0/15";
      paths = [ "${config.xdg.userDirs.documents}" "/conf" ];
      exclude = [
        "/home/*/Pictures"
        "/home/*/Videos"
        "/home/*/go"
        "/home/*/snap"
        "/home/john/john-nas"
      ];
    };
    mtls = {
      enable = true;
      subject = hostname;
      san = [
        "${hostname}"
        "192.168.1.85"
        "spiffe://john-stream.com/ubuntu"
      ];
      lifetime = "1h";
      renew.onCalendar = "*:1/10";
    };
  };

  flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {
    pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
    modules = with inputs.self.modules; [
      homeManager."${hostname}"
    ];
  };
}