{ config, lib, stable_pkgs, unstable_pkgs, ... }:

let
  pkgs = stable_pkgs.x86_64;
  unstable = unstable_pkgs.x86_64;
  vpsip4 = "100.100.1.10";
  homelabipv4 = "10.10.0.10";
in
{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ../../nixos
      ../../../users/blake
      ../../../modules/system
      #../../../modules/holocron
      ../../../modules/homelab
    ];

  home-manager.users.blake.imports = [
  ../../../users/blake/hosts/vaniville.nix
  ];

  system = {
    tailscale.enable = false;
  };
  homelab = {
    ddns.enable = true;
  };

  services.tailscale = {
    enable = true;
    useRoutingFeatures = "server";
  };


  # use the systemd-boot EFI boot loader.
  #boot.loader.systemd-boot.enable = true;

  boot = { 
    loader = {
      efi.canTouchEfiVariables = true;
      grub = {
        enable = true;
        forceInstall = true;
      };
    };
    kernel.sysctl = {
      "net.ipv4.ip_forward" = 1;
    };
  };

 

  # define shell
  programs.zsh.enable = true;
  users.defaultUserShell = pkgs.zsh;

  # package install list
  environment.systemPackages = with pkgs; [
    inetutils
    mtr
    sysstat
  ];

  # allow proprietary packages
  nixpkgs.config.allowUnfree = true;

  # enable flakes
  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  # setup hostname and networking stack
  networking = {
    hostName = "vaniville"; # Define your hostname.
    usePredictableInterfaceNames = false;
    useDHCP = false;
    interfaces.eth0.useDHCP = true;
    #networkmanager.enable = true;  # Easiest to use and most distros use this by default.

    nat = {
      enable = true;
      externalInterface = "eth0";          # your PUBLIC_IF
      internalInterfaces = [ "tailscale0" ];
      forwardPorts = [
#        { sourcePort = 80;    destination = "10.10.0.10:80";    proto = "tcp"; } # http
#        { sourcePort = 443;   destination = "10.10.0.10:443";   proto = "tcp"; } # https
#        { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
#        { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
#        { sourcePort = 7567;  destination = "10.10.0.10:7567";  proto = "tcp"; } # git
  
        # Rustdesk ports
#        { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
#        { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
#        { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
#        { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
#        { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
#        { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
      ];
    };
  
    firewall = {
      enable = true;
      allowedTCPPorts = [ 22 80 443 25777 7567 21115 21116 21117 21118 21119 ];
      # tailscale will also need its UDP port open:
      allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
      trustedInterfaces = [ "tailscale0" ];
      extraCommands = ''
        # Clear any previous rules if you are iterating
        iptables -t nat -F
    
        # DNAT: internet -> homelab over tailscale
        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80        # http
        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443      # https
        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567    # gitea ssh
        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777  # recpro mc
        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777  # recpro mc
        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778  # cbblemon mc
    
        # SNAT: ensure replies go back through VPS tailscale IP
        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}     # http
        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}    # https
        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25778 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # cbblemon mc
      '';
    };
  };


  system.stateVersion = "25.05"; # Did you read the comment?

}