{
  config,
  lib,
  pkgs,
  inputs,
  stable_pkgs,
  unstable_pkgs,
  ...
}: let
  vpsip4 = "100.100.1.10";
  snowbelle_ip = "10.10.0.10";
  lumiose_ip = "10.10.0.11";

  homelab = config.homelab;
in {
  imports = [
    ./hardware-configuration.nix
    ../../nixos
    ../../../users/blake
    ../../../modules/system
    ../../../modules/homelab
    #../../../modules/holocron
  ];

  home-manager.users.blake.imports = [
    ../../../users/blake/hosts/vaniville.nix
  ];

  system = {
    tailscale.enable = false;
  };
  homelab = {
    enable = true;
    base_domain = "vaniville.lan";
    host_ip = "10.10.0.11";
    ddns.enable = true;
    uptime-kuma = {
      enable = true;
      url = "up.holocron.blue";
    };
    caddy = {
      enable = true;
      keys = true;
    };
    backups = {
      enable = true;
      databases = false;
      backup_repo = "/var/lib/backups/homelab";
      offsite_dir = "/lifeboat/vaniville/homelab";
    };
    home.enable = false;
  };

  boot = {
    loader = {
      efi.canTouchEfiVariables = true;
      grub = {
        enable = true;
        forceInstall = true;
      };
    };
    kernel.sysctl = {
      "net.ipv4.ip_forward" = 1;
    };
  };

  # define shell
  programs.zsh.enable = true;
  users.defaultUserShell = pkgs.zsh;

  # packages reccomended by linode
  environment.systemPackages = with pkgs; [
    inetutils
    mtr
    sysstat
  ];

  #  services.resolved = {
  #    enable = true;
  #    settings = {
  #      Resolve = {
  #        FallbackDNS = ["1.1.1.1" "9.9.9.9"];
  #        DNSOverTLS = "opportunistic";
  #      };
  #    };
  #  };

  # setup the network forwarding this host is designed for
  # general networking config
  networking = {
    hostName = "vaniville"; # Define your hostname.
    usePredictableInterfaceNames = false;
    useDHCP = false;
    interfaces.eth0.useDHCP = true; # public ipv4 interface

    # the proper way to forward ports on nixos, need to figure it out locally then try to get it working over vps
    nat = {
      enable = true;
      externalInterface = "eth0"; # your PUBLIC_IF
      internalInterfaces = ["tailscale0"];
      # maybe one day i will figure out the forward ports proper
      forwardPorts = [
        #        { sourcePort = 80;    destination = "10.10.0.10:80";    proto = "tcp"; } # http
        #        { sourcePort = 443;   destination = "10.10.0.10:443";   proto = "tcp"; } # https
        #        { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
        #        { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
        #        { sourcePort = 7567;  destination = "10.10.0.10:7567";  proto = "tcp"; } # git

        # Rustdesk ports
        #        { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
        #        { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
        #        { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
        #        { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
        #        { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
        #        { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
      ];
    };

    # what actually does the forwarding
    firewall = {
      enable = true;
      allowedTCPPorts = [22 80 443 25777 25579 7567 21115 21116 21117 21118 21119];
      # tailscale will also need its UDP port open:
      allowedUDPPorts = [config.services.tailscale.port 25777 21116 25580];
      trustedInterfaces = ["tailscale0"];
      /*
      iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${snowbelle_ip}:80        # http
      iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${snowbelle_ip}:443      # https

      iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}     # http
      iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}    # https
      */
      extraCommands = ''
        # Clear any previous rules if you are iterating
        iptables -t nat -F

        # DNAT: internet -> homelab over tailscale
        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567    # gitea ssh
        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777  # recpro mc
        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777  # recpro mc
        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25579 -j DNAT --to-destination ${snowbelle_ip}:25579  # craftoria mc
        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25580 -j DNAT --to-destination ${snowbelle_ip}:25580  # craftoria mc voice chat

        # SNAT: ensure replies go back through VPS tailscale IP
        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25579 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # craftoria mc
        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25580 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # craftoria mc voicechat
      '';
    };
  };

  # enable tailscale for to forward over!
  services.tailscale = {
    enable = true;
    useRoutingFeatures = "server";
    extraSetFlags = [
      "--advertise-exit-node"
    ];
  };

  # forwarding for caddy
  services.caddy = {
    globalConfig = ''
      auto_https ignore_loaded_certs
    '';
    virtualHosts = {
      # for central uptime monitoring
      "up.${homelab.public_domain}".extraConfig = ''
        reverse_proxy 127.0.0.1:7901
      '';
      # below is basically just manually reverse proxying everything in the homelab
      # this is instead of forwarding all 80 & 443 traffic to have more explicit
      # publishing things to the open web
      "media.${homelab.public_domain}".extraConfig = ''
        reverse_proxy ${lumiose_ip}:7100
      '';
      "pass.${homelab.public_domain}".extraConfig = ''
        reverse_proxy ${lumiose_ip}:7701
      '';
      "photos.${homelab.public_domain}".extraConfig = ''
        reverse_proxy ${lumiose_ip}:7702
      '';
      "git.${homelab.public_domain}".extraConfig = ''
        reverse_proxy ${lumiose_ip}:7703
      '';
      "hass.${homelab.public_domain}".extraConfig = ''
          reverse_proxy ${lumiose_ip}:7704 {
          header_up Host {host}
          header_up X-Real-IP {remote_host}
          header_up X-Forwarded-For {remote_host}
          header_up X-Forwarded-Proto https
        }
      '';
    };
  };

  system.stateVersion = "25.05"; # Did you read the comment?
}