{ config, pkgs, inputs, ... }:

{
  sops.secrets.cache_priv = {};
  sops.secrets.gitea_token = {
    owner = "hydra";
    group = "hydra";
    mode = "0440";
  };

  services.postfix = {
    enable = true;
    setSendmail = true;
  };

  imports =
    [
      inputs.self.nixosModules.malobeo.gitea-translator
    ];

  services.malobeo.gitea-translator = {
    enable = true;
  };

  services.hydra = {
    enable = true;
    hydraURL = "https://hydra.malobeo.org";
    useSubstitutes = true;
    notificationSender = "hydra@localhost";

    extraConfig = ''
      store_uri = file:///var/lib/hydra/cache?secret-key=/etc/nix/albert/secret
      binary_cache_secret_key_file = /etc/nix/albert/secret
      binary_cache_dir = /var/lib/hydra/cache
      Include ${config.sops.secrets.gitea_token.path}
      using_frontend_proxy 1
      base_uri hydra.malobeo.org
      <hydra_notify>
        <prometheus>
          listen_address = 0.0.0.0
          port = 9199
        </prometheus>
      </hydra_notify>
      queue_runner_metrics_address = 0.0.0.0:9198
    '';
  };
  networking.firewall.allowedTCPPorts = [ 9199 9198 ];
  
  systemd.services.hydra-manual-setup = {
    description = "Create Admin User for Hydra";
    serviceConfig.Type = "oneshot";
    serviceConfig.RemainAfterExit = true;
    wantedBy = [ "multi-user.target" ];
    requires = [ "hydra-init.service" ];
    after = [ "hydra-init.service" ];
    environment = builtins.removeAttrs (config.systemd.services.hydra-init.environment) ["PATH"];
    script = ''
      if [ ! -e ~hydra/.setup-is-complete ]; then
        # create signing keys
        /run/current-system/sw/bin/install -d -m 551 /etc/nix/albert
        /run/current-system/sw/bin/nix-store --generate-binary-cache-key albert /etc/nix/albert/secret /etc/nix/albert/public
        /run/current-system/sw/bin/chown -R hydra:hydra /etc/nix/albert
        /run/current-system/sw/bin/chmod 440 /etc/nix/albert/secret
        /run/current-system/sw/bin/chmod 444 /etc/nix/albert/public
        # create cache
        /run/current-system/sw/bin/install -d -m 755 /var/lib/hydra/cache
        /run/current-system/sw/bin/chown -R hydra-queue-runner:hydra /var/lib/hydra/cache
        # done
        touch ~hydra/.setup-is-complete
      fi
    '';
  };

  nix.gc = {
    automatic = true;
    dates = "15 3 * * *"; # [1]
  };


  nix.settings.trusted-users = ["hydra" "hydra-evaluator" "hydra-queue-runner"];
  nix.settings.auto-optimise-store = true;

  services.nix-serve = {
    enable = true;
    secretKeyFile = config.sops.secrets.cache_priv.path;
  };

  nix.buildMachines = [
    {
      hostName = "localhost";
      systems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
      protocol = null;
      maxJobs = 6;
      supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
    }
  ];

  nix.settings.allowed-uris = [
    "github:"
    "git+https://github.com/"
    "git+ssh://github.com/"
    "https://github.com/nixos/nixpkgs"

    "git+https://git.dynamicdiscord.de/"
    "git+ssh://git.dynamicdiscord.de/"
    "https://git.dynamicdiscord.de"
  ];
}