{ config, pkgs, lib, ... }: {

  imports = [
    ./hardware-configuration.nix
    ./networking.nix # generated at runtime by nixos-infect
    ./modules/smart-ipv6-rotator.nix # ipv6 rotator
    ./modules/watchdog.nix # anubis watchdog to auto-report to abuseipdb
  ];

  environment.systemPackages = with pkgs; [
    (lib.hiPrio pkgs.uutils-coreutils-noprefix)
    (lib.hiPrio pkgs.uutils-findutils)
    (lib.hiPrio pkgs.uutils-diffutils)
    fastfetch # fetch stats!
    btop
    python3Minimal
    git
    gnuplot
    ctop
    starship
    nftables
  ];


  users.users.nune = {
    isNormalUser = true;
    description = "Admin user";
    createHome = true;
    extraGroups = [ "wheel" "docker" ];
    shell = pkgs.zsh;
    openssh.authorizedKeys.keys = [
     "ssh-ed25519 XXXXX" # i know its fine to share but im a goober
    ];
  };

  programs.zsh = {
    enable = true;
    shellAliases = {
     ne = "sudo nano /etc/nixos/configuration.nix && sudo nixos-rebuild switch";
     ncg = "sudo nix-collect-garbage";
    };
  };

  programs.starship.enable = true;

  # enable sudo; keep password requirement by default
  security.sudo.enable = true;
  security.sudo.wheelNeedsPassword = true;

  services.snowflake-proxy = {
    enable = true;
    capacity = 50;
  };


  services.yggdrasil = {
    enable = true;
    persistentKeys = true;

    settings = {
      Peers = [
        "tcp://[2a14:1e00:3:15c::]:65535"
        "ws://vpn.itrus.su:7994"
        "tls://23.137.249.65:444"
        "tcp://[2001:470:1f13:e56::64]:39565"
        "tcp://51.15.204.214:12345"
        "tcp://[2a0b:4142:e9e::2]:65535"
        "tcp://[2a0c:b641:ce0::25d8:c5d6]:65535"
        "tls://n.ygg.yt:443"
        "tcp://94.159.110.4:65535"
        "tcp://[2a0b:4142:ce0::2]:65535"
        ];
      Listen = [
        "tls://0.0.0.0:32000"
        "tls://[::]:32000"
      ];
    };
  };

  services.i2pd = {
    enable = true;
    enableIPv4 = true;
    port = 35252;
    address = "91.98.126.143" ;
    enableIPv6 = true;    # if you don't have IPv6, leave false
    ifname = "eth0";       # change to your interface
    bandwidth = 1000;       # limit to 500 KB/s (≈ 4 Mb/s)
    share = 50;            # allocate 50% of that to transit
    notransit = false;     # allow transit
    floodfill = false;     # not acting as floodfill
    nat = true;            # if behind NAT
};

  networking.firewall.enable = true;
  networking.firewall.trustedInterfaces = [ "lo" ]; # loopback
  networking.firewall.allowedTCPPorts = [ 22 80 443 8080 9091 51413 4001 8013 27905 32000 31311 31312 31313 31314 35252];
  networking.firewall.allowedUDPPorts = [ 51413 ];  # Transmission uses UDP for DHT/peer discovery

  services.tailscale.enable = true;

  services.smart-ipv6-rotator = {
    enable = true;
    ipv6range = "2a01:4f8:c2c:c398::/64";
    rev = "master";
    sha256 = "sha256-g2M+obfTGya3bPkNRvpptaBIx0X+94262vEfponycTY=";
  };

  services.cron = {
    enable = true;
    systemCronJobs = [
      "* * * * * /root/trafficgen.sh >> /var/log/generate_traffic_png.log 2>&1"
      "0 */6 * * *  docker restart instafix_proxy"
      "0 */12 * * *  docker system prune -a -f"
      "0 */1 * * * /bin/bash -lc 'for i in {1..10}; do [ -d /srv/arti$i/cache/dir_blobs ] && find /srv/arti$i/cache/dir_blobs -mindepth 1 -maxdepth 1 -exec rm -rf {} +; done'" # clear redlib cache
    ];
  };

  services.caddy = {
    enable = true;
    logFormat = ''level INFO'';
    logDir = ''/var/log/caddy'';
    virtualHosts."fan.blitzw.in".extraConfig = ''
      reverse_proxy localhost:10417
    '';
    virtualHosts."skylib.blitzw.in".extraConfig = ''
      reverse_proxy localhost:5081
    '';
    virtualHosts."tent.blitzw.in".extraConfig = ''
      reverse_proxy localhost:5083
    '';
    virtualHosts."small.blitzw.in".extraConfig = ''
      reverse_proxy localhost:5084
    '';
    virtualHosts."pinata.blitzw.in".extraConfig = ''
      reverse_proxy localhost:4100
    '';
    virtualHosts."tube.blitzw.in".extraConfig = ''
      basicauth {
        guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC
      }
        reverse_proxy 100.76.137.52:33020
    '';
    virtualHosts."hooligan.srv.blitzw.in".extraConfig = ''
      root * /srv/landing
      file_server
    '';
    virtualHosts."mirage.blitzw.in".extraConfig= ''
      reverse_proxy localhost:35200 {
                header_up X-Real-Ip {remote_host}
                header_up X-Http-Version {http.request.proto}
                header_up X-Forwarded-Host {host}
                header_up Host {host}
                header_up Referer {>Referer}
     }
    '';
    virtualHosts."priviblur.blitzw.in".extraConfig= ''
      reverse_proxy localhost:24215 {
                header_up X-Real-Ip {remote_host}
                header_up X-Http-Version {http.request.proto}
                header_up X-Forwarded-Host {host}
                header_up Host {host}
                header_up Referer {>Referer}
     }
    '';
    virtualHosts."genius.blitzw.in".extraConfig=''
      reverse_proxy localhost:2006 {
                header_up X-Real-Ip {remote_host}
                header_up X-Http-Version {http.request.proto}
                header_up X-Forwarded-Host {host}
                    header_up Host {host}
     }
    '';
    virtualHosts."pin.blitzw.in".extraConfig= ''
      reverse_proxy localhost:6600
    '';
    virtualHosts."search.blitzw.in".extraConfig = ''
      reverse_proxy localhost:24999
    '';
    virtualHosts."wikimore.blitzw.in".extraConfig = ''
      reverse_proxy localhost:8109
    '';
    virtualHosts."twitch.blitzw.in".extraConfig = ''
      reverse_proxy localhost:5600
    '';
    virtualHosts."moz.blitzw.in".extraConfig = ''
      reverse_proxy localhost:3012
    '';
    virtualHosts."rl.blitzw.in".extraConfig = ''
      respond "301 Moved Permanently" 301
    '';
    virtualHosts."bilder.blitzw.in".extraConfig = ''
      basicauth {
        guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC
      }
      reverse_proxy localhost:4243
    '';
    virtualHosts."sc.blitzw.in".extraConfig = ''
      basicauth {
        guest $2a$08$n0D.stczLfrMFJLleu7i5uAxpmwEs.EvjTlitmEAFvopi5xOqzK4y
      }
      reverse_proxy localhost:4665
    '';
    virtualHosts."yt2009.blitzw.in".extraConfig = ''
      basicauth {
        guest $2a$12$o/yxcMasmTKgCJGVmUNZ4OYYDHL4iPOeMgiZvUZrnoxtTWTnOBDke
      }
      reverse_proxy localhost:2009
    '';
    virtualHosts."ladder.blitzw.in".extraConfig = ''
      reverse_proxy localhost:28000
    '';
    virtualHosts."lens.blitzw.in".extraConfig = ''
      reverse_proxy localhost:4664
    '';
    virtualHosts."lf.blitzw.in".extraConfig = ''
      basicauth {
        lf $2a$12$HBepdgYKEdIEJ.bn0F4xUOHWciPK2mbBEAo2C3XDVD03ljnUmmTz6
      }
      reverse_proxy localhost:46000
    '';
    virtualHosts."test.blitzw.in".extraConfig = ''
      reverse_proxy localhost:28001
    '';
    virtualHosts."fxstagram.com".extraConfig = ''
        root * /srv/instafix

        @root path /
        handle @root {
                file_server
        }

        @traffic path /traffic.png
        handle @traffic {
                file_server
        }

        handle {
                reverse_proxy localhost:3000
        }
    '';
    virtualHosts."fxstagram.com".serverAliases = [ "www.fxstagram.com" "1.fxstagram.com" "2.fxstagram.com" "3.fxstagram.com" ];
  };

  # ... your other config ...

services.journald.extraConfig = ''
  # keep journals on disk (persistent) instead of only in /run
  Storage=persistent

  # keep more log data before rotation / vacuuming
  # adjust these to taste (units: K M G)
  RuntimeMaxUse=1G
  RuntimeMaxFileSize=100M

  SystemMaxUse=4G
  SystemMaxFileSize=200M
  SystemMaxFiles=100

  # optionally keep logs for up to a time limit (if your systemd supports it)
  # MaxRetentionSec=90d
'';

# ensure journals are flushed from /run to /var on shutdown so persistence works
systemd.services.systemd-journal-flush.enable = true;

  virtualisation.docker.enable = true;
  boot.tmp.cleanOnBoot = true;
  zramSwap.enable = true;
  networking.hostName = "hooligan";
  networking.domain = "";
  services.openssh = {
    enable = true;
    permitRootLogin = "no";            # disallow root SSH
    passwordAuthentication = false;    # disable password auth for SSH entirely
    challengeResponseAuthentication = false;
    extraConfig = ''
      AllowUsers nune
    '';
  };
  users.users.root.openssh.authorizedKeys.keys = [ ];
  system.stateVersion = "23.11";
}