{ config, adminUser, ... }:
{
  imports = [
    ../../../profiles/cgroups.nix
    ../../../profiles/defaults.nix
    ../../../profiles/disk/basic-vm.nix
    ../../../profiles/hardware/do-droplet.nix
    ../../../profiles/home-manager.nix
    ../../../profiles/server.nix
  ];

  age = {
    secrets = {
      cloudflare-nginx = {
        file = ../../../secrets/cloudflare-nginx.age;
      };
      wireguard = {
        file = ../../../secrets/do/wireguard.age;
      };
    };
  };

  disko.devices.disk.disk1.device = "/dev/vda";

  networking.hostName = "do-rproxy";

  networking.wireguard = {
    enable = true;
    interfaces.wg0 = {
      ips = [ "10.100.0.50/32" ];
      listenPort = 51871;
      privateKeyFile = config.age.secrets.wireguard.path;
      peers = [
        {
          # vm-synology
          publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904=";
          allowedIPs = [ "10.100.0.40/32" ];
          persistentKeepalive = 25;
        }
        {
          # rivendell
          publicKey = "jf7T7TMKQWSgSXhUplldZDV9G2y2BjMmHIAhg5d26ng=";
          allowedIPs = [ "10.100.0.60/32" ];
          persistentKeepalive = 25;
        }
      ];
    };
  };

  networking.firewall.trustedInterfaces = [ "wg0" ];
  networking.firewall.allowedUDPPorts = [ 51871 ];

  system.stateVersion = "25.05"; # Did you read the comment?

  networking.firewall.allowedTCPPorts = [
    80
    443
  ];

  security.acme = {
    acceptTerms = true;
    defaults.email = "franck@fcuny.net";
    certs = {
      "code.fcuny.net" = {
        dnsProvider = "cloudflare";
        dnsResolver = "1.1.1.1";
        reloadServices = [ "nginx.service" ];
        credentialFiles.CF_DNS_API_TOKEN_FILE = config.age.secrets."cloudflare-nginx".path;
      };
      "fcuny.net" = {
        dnsProvider = "cloudflare";
        dnsResolver = "1.1.1.1";
        reloadServices = [ "nginx.service" ];
        credentialFiles.CF_DNS_API_TOKEN_FILE = config.age.secrets."cloudflare-nginx".path;
      };
    };
  };

  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedTlsSettings = true;
    virtualHosts = {
      "code.fcuny.net" = {
        enableACME = true;
        acmeRoot = null;
        forceSSL = true;
        locations."/" = {
          proxyPass = "http://10.100.0.60";
        };
      };
      "fcuny.net" = {
        enableACME = true;
        acmeRoot = null;
        forceSSL = true;
        locations."/" = {
          proxyPass = "http://10.100.0.60:8070";
        };
      };
    };
  };

  home-manager = {
    users.${adminUser.name} = {
      imports = [
        ../../../home/profiles/minimal.nix
      ];
    };
  };
}