{ config, pkgs, lib, ... }: {

  boot.kernel.sysctl."net.core.rmem_max" = 16777216;
  boot.kernel.sysctl."net.core.wmem_max" = 16777216;

  imports = [
    ./hardware-configuration.nix
    ./networking.nix # generated at runtime by nixos-infect
    ./modules/smart-ipv6-rotator.nix
    ./modules/watchdog.nix
  ];

  environment.systemPackages = with pkgs; [
    (lib.hiPrio pkgs.uutils-coreutils-noprefix)
    (lib.hiPrio pkgs.uutils-findutils)
    (lib.hiPrio pkgs.uutils-diffutils)
    fastfetch # fetch stats!
    compose2nix
    btop
    python3Minimal
    git
    gnuplot
    ctop
    starship
    nftables
  ];


  users.users.nune = {
    isNormalUser = true;
    description = "Admin user";
    createHome = true;
    extraGroups = [ "wheel" "docker" ];
    shell = pkgs.zsh;
    openssh.authorizedKeys.keys = [
     "ssh-ed25519 XXXX"
    ];
  };

  programs.zsh = {
    enable = true;
    shellAliases = {
     ne = "sudo nano /etc/nixos/configuration.nix && sudo nixos-rebuild switch";
     ncg = "sudo nix-collect-garbage";
    };
  };

  programs.starship.enable = true;

  environment.memoryAllocator.provider = "jemalloc";

  # enable sudo; keep password requirement by default
  security.sudo.enable = true;
  security.sudo.wheelNeedsPassword = true;

  services.snowflake-proxy = {
    enable = true;
    capacity = 50;
  };

  services.irqbalance.enable = true;

  services.yggdrasil = {
    enable = true;
    persistentKeys = true;

    settings = {
      Peers = [
        "tcp://[2a14:1e00:3:15c::]:65535"
        "ws://vpn.itrus.su:7994"
        "tls://23.137.249.65:444"
        "tcp://[2001:470:1f13:e56::64]:39565"
        "tcp://51.15.204.214:12345"
        "tcp://[2a0b:4142:e9e::2]:65535"
        "tcp://[2a0c:b641:ce0::25d8:c5d6]:65535"
        "tls://n.ygg.yt:443"
        "tcp://94.159.110.4:65535"
        "tcp://[2a0b:4142:ce0::2]:65535"
        ];
      Listen = [
        "tls://0.0.0.0:32000"
        "tls://[::]:32000"
      ];                                                                                                                                                                                                    };
  };

  services.i2pd = {
    enable = true;
    enableIPv4 = true;
    port = 35252;
    address = "91.98.126.143" ;
    enableIPv6 = true;    # if you don’t have IPv6, leave false
    ifname = "eth0";       # change to your interface
    bandwidth = 1000;       # limit to 500 KB/s (≈ 4 Mb/s)
    share = 50;            # allocate 50% of that to transit
    notransit = false;     # allow transit
    floodfill = false;     # not acting as floodfill
    nat = true;            # if behind NAT
};

  networking.firewall.enable = true;
  networking.firewall.trustedInterfaces = [ "lo" ]; # loopback
  networking.firewall.allowedTCPPorts = [ 22 80 443 8080 9091 51413 4001 8013 27905 32000 31311 31312 31313 31314 35252];
  networking.firewall.allowedUDPPorts = [ 51413 ];  # Transmission uses UDP for DHT/peer discovery

  services.tailscale.enable = true;

  services.smart-ipv6-rotator = {
    enable = true;
    ipv6range = "2a01:4f8:c2c:c398::/64";
    rev = "master";
    sha256 = "sha256-g2M+obfTGya3bPkNRvpptaBIx0X+94262vEfponycTY=";
  };


  systemd.services.ipfs_restart = {
    description = "Restart ipfs docker container";
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${pkgs.docker}/bin/docker restart ipfs-ipfs-1";
    };
  };

  systemd.timers.ipfs_restart = {
    wantedBy = [ "timers.target" ];
    timerConfig = {
      # run roughly every 6 hours after previous run
      OnUnitActiveSec = "6h";
      Persistent = true;
    };
  };

  systemd.services.instafix_proxy_restart = {
    description = "Restart instafix_proxy docker container";
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${pkgs.docker}/bin/docker restart instafix_proxy";
    };
  };

  systemd.timers.instafix_proxy_restart = {
    wantedBy = [ "timers.target" ];
    timerConfig = {
      # run roughly every 6 hours after previous run
      OnUnitActiveSec = "6h";
      Persistent = true;
    };
  };

  systemd.services.docker_system_prune = {
    description = "Prune docker system";
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${pkgs.docker}/bin/docker system prune -a -f";
    };
  };

  systemd.timers.docker_system_prune = {
    wantedBy = [ "timers.target" ];
    timerConfig = { OnUnitActiveSec = "12h"; Persistent = true; };
  };

  services.caddy = {
    enable = true;
    logFormat = ''level INFO'';
    logDir = ''/var/log/caddy'';
    virtualHosts."fan.blitzw.in".extraConfig = ''
      reverse_proxy localhost:10417
    '';
    virtualHosts."quora.blitzw.in".extraConfig = ''
        reverse_proxy localhost:21490
    '';
    virtualHosts."ms.blitzw.in".extraConfig = ''
        reverse_proxy localhost:28019
    '';
    virtualHosts."rss.blitzw.in".extraConfig = ''
        reverse_proxy localhost:34141
    '';
    virtualHosts."transfer.blitzw.in".extraConfig = ''
        reverse_proxy localhost:8105
    '';
    virtualHosts."tracker.transfer.blitzw.in".extraConfig = ''
        reverse_proxy localhost:8106
    '';
    virtualHosts."stirlingpdf.blitzw.in".extraConfig = ''
        reverse_proxy localhost:24160
    '';
    virtualHosts."skylib.blitzw.in".extraConfig = ''
      reverse_proxy localhost:5081
    '';
    virtualHosts."tent.blitzw.in".extraConfig = ''
      reverse_proxy localhost:5083
    '';
    virtualHosts."small.blitzw.in".extraConfig = ''
      reverse_proxy localhost:5084
    '';
    virtualHosts."rimgo.blitzw.in".extraConfig = ''
      reverse_proxy localhost:43000
    '';
    virtualHosts."pinata.blitzw.in".extraConfig = ''
      reverse_proxy localhost:4100
    '';
    virtualHosts."tube.blitzw.in".extraConfig = ''
      basicauth {
        guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC
      }
        reverse_proxy 100.76.137.52:33020
    '';
    virtualHosts."hooligan.srv.blitzw.in".extraConfig = ''
      root * /srv/landing
      file_server
    '';
    virtualHosts."mirage.blitzw.in".extraConfig= ''
      reverse_proxy localhost:35200 {
                header_up X-Real-Ip {remote_host}
                header_up X-Http-Version {http.request.proto}
                header_up X-Forwarded-Host {host}
                header_up Host {host}
                header_up Referer {>Referer}
     }
    '';
    virtualHosts."priviblur.blitzw.in".extraConfig= ''
      reverse_proxy localhost:24215 {
                header_up X-Real-Ip {remote_host}
                header_up X-Http-Version {http.request.proto}
                header_up X-Forwarded-Host {host}
                header_up Host {host}
                header_up Referer {>Referer}
     }
    '';
    virtualHosts."genius.blitzw.in".extraConfig=''
      reverse_proxy localhost:2006 {
                header_up X-Real-Ip {remote_host}
                header_up X-Http-Version {http.request.proto}
                header_up X-Forwarded-Host {host}
                    header_up Host {host}
     }
    '';
    virtualHosts."pin.blitzw.in".extraConfig= ''
      redir https://pinata.blitzw.in
    '';
    virtualHosts."search.blitzw.in".extraConfig = ''
      reverse_proxy localhost:24999
    '';
    virtualHosts."wikimore.blitzw.in".extraConfig = ''
      reverse_proxy localhost:8109
    '';
    virtualHosts."twitch.blitzw.in".extraConfig = ''
      respond "404 Not Found" 404
    '';
    virtualHosts."moz.blitzw.in".extraConfig = ''
      reverse_proxy localhost:3012
    '';
    virtualHosts."rl.blitzw.in".extraConfig = ''
      respond "301 Moved Permanently" 301
    '';
    virtualHosts."bilder.blitzw.in".extraConfig = ''
      basicauth {
        guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC
      }
      reverse_proxy localhost:4243
    '';
    virtualHosts."sc.blitzw.in".extraConfig = ''
      basicauth {
        guest $2a$08$n0D.stczLfrMFJLleu7i5uAxpmwEs.EvjTlitmEAFvopi5xOqzK4y
      }
      reverse_proxy localhost:4665
    '';
    virtualHosts."yt2009.blitzw.in".extraConfig = ''
      basicauth {
        guest $2a$12$o/yxcMasmTKgCJGVmUNZ4OYYDHL4iPOeMgiZvUZrnoxtTWTnOBDke
      }
      reverse_proxy localhost:2009
    '';
    virtualHosts."ladder.blitzw.in".extraConfig = ''
      reverse_proxy localhost:28000
    '';
    virtualHosts."lens.blitzw.in".extraConfig = ''
      reverse_proxy localhost:4664
    '';
    virtualHosts."lf.blitzw.in".extraConfig = ''
      basicauth {
        lf $2a$12$HBepdgYKEdIEJ.bn0F4xUOHWciPK2mbBEAo2C3XDVD03ljnUmmTz6
      }
      reverse_proxy localhost:46000
    '';
    virtualHosts."test.blitzw.in".extraConfig = ''
      reverse_proxy localhost:28001
    '';
    virtualHosts."fxstagram.com".extraConfig = ''
        root * /srv/instafix

        @root path /
        handle @root {
                file_server
        }

        @traffic path /traffic.png
        handle @traffic {
                file_server
        }

        handle {
                reverse_proxy localhost:3000
        }
    '';
    virtualHosts."fxstagram.com".serverAliases = [ "www.fxstagram.com" "1.fxstagram.com" "2.fxstagram.com" "3.fxstagram.com" ];
  };

  # ... your other config ...

services.journald.extraConfig = ''
  # keep journals on disk (persistent) instead of only in /run
  Storage=persistent

  # keep more log data before rotation / vacuuming
  # adjust these to taste (units: K M G)
  RuntimeMaxUse=1G
  RuntimeMaxFileSize=100M

  SystemMaxUse=4G
  SystemMaxFileSize=200M
  SystemMaxFiles=100

  # optionally keep logs for up to a time limit (if your systemd supports it)
  # MaxRetentionSec=90d
'';

# ensure journals are flushed from /run to /var on shutdown so persistence works
  systemd.services.systemd-journal-flush.enable = true;

  virtualisation.docker.enable = true;

  virtualisation.docker.daemon.settings = {
    ipv6 = true;
    # Pick an IPv6 subnet for your containers; e.g. fd00::/80 or something from your network
    fixed-cidr-v6 = "fd00:dead:beef::/80";
    # Optionally, configure default address pools to include both IPv4 and IPv6
    default-address-pools = [
      { base = "172.17.0.0/12"; size = 24; }            # IPv4 pool
      { base = "10.10.0.0/16"; size = 24; }      # optional extra pool (more /24s)
      { base = "fd00:dead:beef::/48"; size = 64; }       # IPv6 pool — adjust prefix & size as needed
    ];
  };

  boot.tmp.cleanOnBoot = true;
  zramSwap.enable = true;
  networking.hostName = "hooligan";
  networking.domain = "";
  services.openssh = {
    enable = true;
    permitRootLogin = "no";            # disallow root SSH
    passwordAuthentication = false;    # disable password auth for SSH entirely
    challengeResponseAuthentication = false;
    extraConfig = ''
      AllowUsers nune
    '';
  };
  users.users.root.openssh.authorizedKeys.keys = [ ];
  system.stateVersion = "23.11";
}