configuration.nix##hostname.nipsu

{ lib, config, pkgs, ... }:
{
  imports = [
    ./common.nix
  ];

  networking.hostName = "nipsu";

  system.stateVersion = "21.03";

  # UEFI boot
  boot.loader.systemd-boot.enable = true;
  #boot.loader.grub.grubDevice = "/dev/disk/by-id/ata-Samsung_SSD_860_EVO_2TB_S4X1NE0MA03611M";

  swapDevices = [
    {
      device = "/media/swapfile";
      size = 4096;
    }
  ];

  # Use local checkout of nixpkgs
  nix.nixPath = [
    "nixpkgs=/etc/nixpkgs"
    "nixos-config=/etc/nixos/configuration.nix"
  ];

  nixpkgs.jellyfinMediaPlayerEnv = {
    # Jellyfin Media Player requires older driver on nipsu, otherwise video
    # playback is super slow (no hardware acceleration?)
    LIBVA_DRIVER_NAME = "i965";
  };

  # Monero daemon P2P and RPC ports
  networking.firewall = {
    allowedTCPPorts = [ 18080 18081 ];
  };

  users.predefinedUsers = {
    # Add those users to syncthing group that you want to be able to access
    # (read-only) those files.
    jluttine = [ "wheel" "syncthing" "media" ];
    meri = [ "syncthing" "media" ];
  };

  # Put root home directory under a backed up partition.
  users.users.root.home = lib.mkForce "/var/lib/root";

  services = {

    matrix-synapse = {
      enable = false;
      # NOTE: The configuration for Matrix Synapse is in services/matrix.nix file
    };

    calibre-web = {
      enable = true;
      openFirewall = false;
      listen.ip = "127.0.0.1";
      options = {
        # NOTE: This needs to be a string, otherwise the path is copied to nix
        # store
        calibreLibrary = "/var/lib/calibre-web/library";
        enableBookConversion = true;
        enableBookUploading = true;
      };
    };
    nginx.virtualHosts."kirjahylly.nipsu.fi" = {
      enableACME = true;
      forceSSL = true;
      # Increase upload limits. Note that calibre-web has its own limits in
      # addition to these nginx limits:
      # https://github.com/janeczku/calibre-web/issues/452
      extraConfig = ''
        client_max_body_size 300M;
        send_timeout 300s;
      '';
      locations = {
        "/" = {
          proxyPass = "http://127.0.0.1:8083/";
        };
      };
    };

    syncthing = {
      enable = true;
      defaultVersioning = {
        type = "trashcan";
        params.cleanoutDays = "30";
      };
    };

    printServer = {
      enable = true;
    };

    mopidy = {
      enable = false;
    };

    tuhlaajapojat = {
      enable = true;
      mailserver = {
        enable = true;
      };
    };

    bayesleague = {
      enable = true;
    };

    tv = {
      enable = false;
      domain = "tv.nipsu.fi";
      ssl = true;
    };

    media = {
      enable = true;
      domain = "media.nipsu.fi";
      ssl = true;
    };

    diskrsync = {
      enable = true;
      compress = false;
      snapshotName = "lv-nixos-var-snapshot";
      volumeGroupName = "vg-nixos-var";
      logicalVolumeName = "lv-nixos-var";
      host = "jluttine@kapsi.fi";
      filename = "/home/users/jluttine/siilo/nipsu.img";
      startAt = "01:00";
    };

    radicale = {
      enable = true;
      virtualHost = "paivyri.nipsu.fi";
      ssl = true;
      # Create/modify htpasswd file with:
      #   htpasswd -B radicale-passwords username
      htpasswd = lib.readFile ./passwords/radicale-passwords;
    };

    emptyDomain = {
      enable = true;
      domain = "nipsu.fi";
    };

    # SSH server
    openssh = {
      enable = true;
      ports = [6662];
      settings = {
        PermitRootLogin = "no";
        PasswordAuthentication = false;
      };
    };

    # Tiny tiny RSS server
    tt-rss = {
      enable = true;
      virtualHost = "feed.nipsu.fi";
      # MySQL didn't work, see: https://github.com/NixOS/nixpkgs/issues/35469
      database.type = "pgsql";
    };

    monero = {
      enable = true;
      mining = {
        enable = false;
      };
      limits = {
        download = 200;
        upload = 100;
      };
      rpc = {
        #address = "0.0.0.0";
        #address = "127.0.0.1";
        #
        # NOTE: There's no SSL verification support in wallets, so we cannot
        # rely on SSL, so we cannot use login credentials, so we cannot use this
        # outside intranet securely, so we shouldn't open the port in the
        # router.
        #
        # TODO: Set up SSL on both the node and the clients, then use
        # credentials.
        #
        # NOTE: This is the binding address, so it can't be 127.0.0.1 or other
        # machines won't be able to connect to it.
        address = "192.168.10.10";
        port = 18081;
        restricted = true;
        ssl = {
          enable = true;
        };
      };
      #extraConfig = ''
      #  confirm-external-bind=1
      #'';
      extraConfig = ''
        confirm-external-bind=1
        in-peers=4
        out-peers=4
      '';
    };

    # nginx.virtualHosts."monero.nipsu.fi" = {
    #   enableACME = true;
    #   forceSSL = true;
    #   listen = [
    #     {
    #       addr = "0.0.0.0";
    #       port = 80;
    #       ssl = false;
    #     }
    #     {
    #       addr = "0.0.0.0";
    #       port = 443;
    #       ssl = true;
    #     }
    #     {
    #       addr = "0.0.0.0";
    #       port = 18089;
    #       ssl = true;
    #     }
    #   ];
    #   locations = {
    #     "/" = {
    #       proxyPass = "http://localhost:18088/";
    #     };
    #   };
    # };

    # If you ever need to change this, manual migration is required, otherwise
    # the new version will have empty database. See:
    # https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading
    # There is an existing script for v9->v11 upgrade under /var/lib/postgresql
    postgresql.package = pkgs.postgresql_15;

    # DNS for dynamic IP
    ddclient = let
      account = import ./passwords/ddclient-account.nix;
    in {
      enable = true;
      server = "api.cloudflare.com/client/v4";
      username = account.username;
      passwordFile = account.passwordFile;
      protocol = "cloudflare";
      domains = [];
      # The default web API stopped working with SSL
      usev4 = "web, web=api.ipify.org/, web-skip=''";
      # nixpkgs doesn't support multiple zones so we have to use extraConfig
      extraConfig = let
        cfg = {
          "nipsu.fi" = [ "nipsu.fi" ];
          "tuhlaajapojat.fi" = [ "tuhlaajapojat.fi" ];
        };
      in lib.concatStrings (
        lib.mapAttrsToList (
          zone: domains: let
            domainsString = lib.concatStringsSep "," domains;
          in ''
            zone=${zone}
            ${domainsString}
          ''
        ) cfg
      );
    };

    xserver = {
      # # SDDM fails at least on nipsu with video projector. See:
      # #
      # # https://github.com/sddm/sddm/issues/699
      # #
      # # https://wiki.archlinux.org/index.php/SDDM#Screen_resolution_is_too_low
      #
      # # This would solve it:
      #
      # extraConfig = ''
      #   [General]
      #   EnableHiDPI=false
      # '';
      displayManager.lightdm.enable = true;
      desktopManager.plasma5.enable = true;
    };
  };

  programs = {
    mosh.enable = true;
    weechat.enable = true;
    direnv.enable = true;
  };

  environment.systemPackages = with pkgs; [

    # Doom Emacs stuff
    emacs
    ripgrep
    fd

    # Disk space analysis
    ncdu

    # Sync video for among multiple clients
    syncplay

    # VLC was failing on July 23, 2020. Dragon seemed to work fine.
    dragon

    # Disk usage analysis on the command-line
    ncdu

    vlc

    # Run w_scan2 -f c -c FI --output-VLC > /home/jluttine/channels.xspf
    w_scan2

  ];
}