{ inputs, ... }:
let
  username = "john";
  hostname = "janus";
in
{
  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
    modules = with inputs.self.modules; [
      nixos.lxc
      nixos.mysops
      nixos.step-ssh-host
      nixos.step-client
      nixos.step-ca
      inputs.home-manager.nixosModules.home-manager
      nixos."${username}"
      nixos.docker
      nixos.login-text
      nixos.mtls
      ({ config, lib, pkgs, ... }: {
        networking.hostName = hostname;
        loginText.extraServiceStatus = {
          "Step-CA" = "step-ca";
        };
        sops.defaultSopsFile = ./secrets.yaml;
        sops.secrets."janus/ssh_host_ed25519_key" = {
          sopsFile = ./secrets.yaml;
          owner = "root";
          group = "root";
          mode = "0600";
          path = "/etc/ssh/ssh_host_ed25519_key";
          restartUnits = [ "sshd.socket" "step-ssh-host-renew.service" ];
        };
        step-ssh-host = {
          hostname = hostname;
          extraPrincipals = [
            "192.168.1.244"
            "fded:fb16:653e:25da:be24:11ff:fea0:753f"
          ];
        };
        step-ca = {
          rootCertPath = ./root_ca.crt;
          intermediateCertPath = ./intermediate_ca.crt;
          dnsNames = [
            "${hostname}.john-stream.com"
            "192.168.1.244"
          ];
          secrets = {
            sopsFile = ./secrets.yaml;
            caPassword = "janus/ca_password";
            intermediateKey = "janus/intermediate_ca_key";
            sshHostCaKey = "janus/ssh_host_ca_key";
            sshUserCaKey = "janus/ssh_user_ca_key";
            adminProvisionerEncryptedKey = "janus/admin_provisioner_encrypted_key";
          };
        };
        mtls = {
          enable = true;
          subject = hostname;
          san = [
            "${hostname}.john-stream.com"
            "192.168.1.244"
          ];
          bootstrap = {
            enable = true;
            after = [ "network-online.target" "sops-nix.service" "step-ca.service" ];
            wants = [ "network-online.target" "step-ca.service" ];
            provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
          };
        };

        users.users."${username}" = {
          shell = lib.mkForce (
            lib.getExe inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh
          );
        };

        # users.users."${username}".openssh.authorizedKeys.keys = [
        #   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
        # ];

        home-manager.users."${username}" = {
          imports = with inputs.self.modules.homeManager; [
            mysops
            step-client
          ];
          docker.enable = true;
        };
      })
    ];
  };
}