{ pkgs, modulesPath, ... }:
let
  withGitBlock = {
    extraConfig = ''
      location ~ /\.git {
        deny all;
      }
    '';
  };
in
{
  imports = [ (modulesPath + "/installer/scan/not-detected.nix")
              (modulesPath + "/profiles/qemu-guest.nix") ];

  boot.loader.grub = {
    enable = true;
    efiSupport = false;
  };

  networking.hostName = "soleo";

  services.openssh = {
    enable = true;
    settings.PermitRootLogin = "prohibit-password";
  };

  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZABklyeo2an+O94Ra0MLoYGI3LDHnsA+P+CTNye4h3dJHBJXCUV++VcDtBiA5CEDXm4JKvSQPexmN9Gx8lwLGSSR/np3eLh39UjmPvmpahAPqb9HOBoKh4USNX0EmnJAVpOMDQr9Vt7UA49NpaNUXBIfeDwvoG5XAy/CfyyTskCSzZSBORCYNxdk/jWy/fJq85zQbQy35l6KQYsLt3GZJms5WIO0X/4hUiqHOf5FOFXlE9OXSFM31I+faR1lzN3rGPr+tG68mg16Uck4nUKZwBRAHCpoO2aHlyBR7I2EV2ceU6TpAuLnW0RxqPuLsCCXcr96YCydipLR5WERN9cW/05qY7JB12SHZbK4hUTqijGfE8w0iGP4YQvL+H6bfQBJY33+tXF1XvnyqNoaJle3039/W9Sjdzna4DLPh9Ttp/cmJsFLe+qhZTDrlQHnE4u9283R2mLBFRx3tasNYyqfjVgvoR1QFiPQCC6QKAqG4Z5lqz8evslKxfP8bLJPGpVX+z5qjrfVg8D7io1cPyk5HeOgROyBWwmdQNdYqnA/ueFXJGwaXbsDZsrw92rh6lAYp6hWiHvcaShKzKNDfI4N8IS/pLVw/ABnToYLle54t0piWRvZIog5eMVNXUlnOD2Y/LHYB3lBCg5mRfC30DmpONys7f15/48hdsGx77bgV4w== dustin@dustinswan.com"
  ];

  security.acme = {
    acceptTerms = true;
    defaults.email = "dustin@dustinswan.com";
  };

  services.nginx = {
    enable = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    clientMaxBodySize = "500m";
    virtualHosts = {
      "dustinswan.com" = withGitBlock // {
        forceSSL = true;
        enableACME = true;
        serverAliases = [ "www.dustinswan.com" ];
        root = "/var/www/dustinswan.com";
      };
      "resume.dustinswan.com" = withGitBlock // {
        forceSSL = true;
        enableACME = true;
        # serverAliases = [ "www.dustinswan.com" ];
        root = "/var/www/resume.dustinswan.com";
      };
      "swanlabs.org" = withGitBlock // {
        forceSSL = true;
        enableACME = true;
        serverAliases = [ "www.swanlabs.org" ];
	globalRedirect = "dustinswan.com";
      };
      "git.dustinswan.com" = withGitBlock // {
        forceSSL = true;
        enableACME = true;
        locations."/" = {
          proxyPass = "http://localhost:3000";
        };
      };
      "rockwall.farm" = {
        forceSSL = true;
        enableACME = true;
        serverAliases = [ "www.rockwall.farm" ];
        root = "/var/www/rockwall.farm";
      };
    };
  };

  services.forgejo = {
    enable = true;
    settings = {
      server = {
        DOMAIN = "git.dustinswan.com";
        ROOT_URL = "https://git.dustinswan.com";
      };
      service.DISABLE_REGISTRATION = true;
    };
  };

  networking.firewall.allowedTCPPorts = [ 80 443 ];

  # environment.systemPackages = with pkgs; [ ];

  programs.git = {
    enable = true;
    config = {
      user.email = "dustin@dustinswan.com";
      user.name = "Dustin Swan";
    };
  };

  programs.neovim = {
    enable = true;
    defaultEditor = true;
    viAlias = true;
    vimAlias = true;
  };

  system.stateVersion = "25.11";
}