{ withSystem, self, inputs, lib, ... }:
# Intent: NixOS service node for Forgejo + restic with mTLS, host-local secrets, and a paired Home Manager profile for john.
let
  username = "john";
  hostname = "soteria";
  forgejoDomain = "forgejo.john-stream.com";
  ipv4 = "192.168.1.233";
  ipv6 = "fded:fb16:653e:25da:be24:11ff:fe54:aa39";
  sshNames = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
  mtlsNames = sshNames ++ [ forgejoDomain ];
in
{
  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
    modules = with inputs.self.modules; [
      nixos.lxc
      nixos.login-text
      inputs.home-manager.nixosModules.home-manager
      nixos."${username}"
      nixos.ssh-new
      nixos.mtls
      nixos.mysops
      nixos.docker
      nixos.step-client
      nixos.forgejo
      nixos.restic-server
      # nixos.restic-envoy
      ({ config, pkgs, ... }: {
        networking.hostName = hostname;

        # Removes password for sudo
        security.sudo-rs.extraRules = lib.mkAfter [
          {
            users = [ username ];
            commands = [
              {
                command = "ALL";
                options = [ "NOPASSWD" ];
              }
            ];
          }
        ];

        # users.users."${username}".extraGroups = [ "mtls" ];
        mtls = {
          enable = true;
          subject = hostname;
          san = mtlsNames;
          certDir = "/etc/mtls";
          # lifetime = "12h";
          # renew.onCalendar = "*:3/15";
          # renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
          # certReaders = [ config.services.forgejo.user "restic" ];
        };

        forgejo = {
          enable = true;
          root_url = "https://forgejo.john-stream.com";
          https = true;
          port = 443;
          pocketId = {
            enable = true;
            discoveryUrl = "https://pocketid.john-stream.com/.well-known/openid-configuration";
          };
        };

        # resticServer = {
        #   enable = true;
        #   dataDir = "/mnt/restic";
        #   privateRepos = true;
        #   listenAddress = "0.0.0.0:8000";
        #   tls = {
        #     certFile = config.mtls.certFile;
        #     keyFile = config.mtls.keyFile;
        #   };
        # };

        loginText.extraServiceStatus = {
          Docker = "docker";
          "mTLS Renewal" = "mtls-renew.timer";
          "Forgejo" = "forgejo.service";
          "Forgejo Backup" = "forgejo-dump.timer";
          "Restic REST Server" = "restic-rest-server.service";
        };

        ssh-new.certificates = {
          provisioner = "admin";
          host = {
            enable = true;
            extraPrincipals = sshNames;
            autoRenew = true;
          };
          user.enable = true;
        };

        # This provides the secrets at install time
        sops.defaultSopsFile = ./secrets.yaml;

        home-manager.users."${username}".imports = [ inputs.self.modules.homeManager.soteria ];

        environment.systemPackages = [
          inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.my-neovim
          inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh
        ];
      })
    ];
  };

  flake.modules.homeManager.soteria = { config, pkgs, lib, ... }: {
    imports = with inputs.self.modules.homeManager; [
      rebuild
      mysops
      step-client
      ({ config, pkgs, lib, ... }: {
        homeManagerFlakeDir = "${config.xdg.configHome}/home-manager";
        docker.enable = true;

        # This will provide the edit-secrets script targeting this file
        mysops.hostSecretFile = "${config.homeManagerFlakeDir}/modules/hosts/soteria/secrets.yaml";
      })
    ];
  };
}