{ pkgs, config, specialArgs, ... }:

let
  managerIp = "192.168.68.77";
  credentialsFile = "/etc/nixos/smb-credentials";
  mountPoint = "/mnt/media";
  password = builtins.readFile ./password.txt;

  # Create the credentials file content
  credentialsContent = ''
    username=spiderunderurbed
    password=${password}
    domain=WORKGROUP
  '';

  # Bidirectional sync script using unison
  syncScript = pkgs.writeShellScript "sync-jellyfin.sh" ''
    #!/bin/sh
    set -e  # Exit on error

    FLAG="/tmp/sync-jellyfin-flag"

    if [ ! -f "$FLAG" ]; then
      echo "Flag file $FLAG not found, skipping sync."
      exit 0
    fi

    # Create directories if they don't exist
    ${pkgs.coreutils}/bin/mkdir -p /home/spiderunderurbed/jellyfin/config
    ${pkgs.coreutils}/bin/mkdir -p /home/spiderunderurbed/jellyfin/cache
    ${pkgs.coreutils}/bin/mkdir -p /mnt/media/jellyfin/config
    ${pkgs.coreutils}/bin/mkdir -p /mnt/media/jellyfin/cache

    # Set proper permissions
    ${pkgs.coreutils}/bin/chown -R spiderunderurbed:users /home/spiderunderurbed/jellyfin
    ${pkgs.coreutils}/bin/chmod -R 775 /home/spiderunderurbed/jellyfin

    # Sync using unison (bidirectional)
    ${pkgs.unison}/bin/unison -batch -auto /home/spiderunderurbed/jellyfin/config /mnt/media/jellyfin/config
    ${pkgs.unison}/bin/unison -batch -auto /home/spiderunderurbed/jellyfin/cache /mnt/media/jellyfin/cache

    ${pkgs.coreutils}/bin/echo "Bidirectional sync complete for jellyfin config and cache."
  '';

  # File watcher service that triggers sync on changes
  syncDaemon = pkgs.writeShellScript "sync-jellyfin-daemon.sh" ''
    #!/bin/sh
    set -e

    export HOME=/home/spiderunderurbed
    FLAG="/tmp/sync-jellyfin-flag"

    if [ ! -f "$FLAG" ]; then
      echo "Flag file $FLAG not found, skipping sync."
      exit 0
    fi

    while true; do
      # Watch both directories for changes
      ${pkgs.inotify-tools}/bin/inotifywait -r -e modify,create,delete,move \
        /home/spiderunderurbed/jellyfin/config \
        /home/spiderunderurbed/jellyfin/cache \
        /mnt/media/jellyfin/config \
        /mnt/media/jellyfin/cache

      # Wait a moment to avoid rapid successive syncs
      ${pkgs.coreutils}/bin/sleep 2

      # Run the sync script with proper environment
      HOME=/home/spiderunderurbed ${syncScript}
    done
  '';

  mountScript = pkgs.writeShellScript "mount-samba-share.sh" ''
    #!/bin/sh
    set -e  # Exit on error

    # Create the mount point directory if it doesn't exist
    ${pkgs.coreutils}/bin/mkdir -p ${mountPoint}

    # Mount the Samba share with the correct UID, GID, and permissions
    /run/wrappers/bin/mount -t cifs //192.168.68.36/main ${mountPoint} \
      -o credentials=${credentialsFile},iocharset=utf8,uid=1000,gid=100,file_mode=0775,dir_mode=0775

    ${pkgs.coreutils}/bin/echo "Samba share mounted successfully at ${mountPoint}"
  '';

  # Docker Swarm join script
  dockerSwarmJoinScript = pkgs.writeShellScript "docker-swarm-join" ''
    #!/bin/sh
    set -e

    ENABLESWARM=$(${pkgs.coreutils}/bin/cat "${config.secrets.enableswarm.file}")
    if [ "$ENABLESWARM" != "true" ]; then
      ${pkgs.coreutils}/bin/echo "Docker Swarm not enabled"
      exit 0
    fi

    if ${pkgs.docker}/bin/docker info --format '{{.Swarm.LocalNodeState}}' | ${pkgs.gnugrep}/bin/grep -q "active"; then
      ${pkgs.coreutils}/bin/echo "Already in Docker Swarm"
      exit 0
    fi

    TOKEN=$(${pkgs.coreutils}/bin/cat "${config.secrets.dockerswarm.file}")
    ${pkgs.coreutils}/bin/echo "Joining Docker Swarm..."
    exec ${pkgs.docker}/bin/docker swarm join --token "$TOKEN" ${managerIp}:2377
  '';

  # Docker Swarm monitor script
  dockerSwarmMonitorScript = pkgs.writeShellScript "docker-swarm-monitor" ''
    #!/bin/sh
    set -e

    ENABLESWARM=$(${pkgs.coreutils}/bin/cat "${config.secrets.enableswarm.file}")
    if [ "$ENABLESWARM" != "true" ]; then
      exit 0
    fi

    while true; do
      if ! ${pkgs.docker}/bin/docker info --format '{{.Swarm.LocalNodeState}}' | ${pkgs.gnugrep}/bin/grep -q "active"; then
        ${pkgs.coreutils}/bin/echo "Not in Swarm, attempting to join..."
        ${pkgs.systemd}/bin/systemctl restart docker-swarm-join
      fi
      ${pkgs.coreutils}/bin/sleep 30
    done
  '';

  # Kubernetes join script
  k8sJoinScript = pkgs.writeShellScript "k8s-join" ''
    #!/bin/sh
    set -e

    ENABLEK8S=$(${pkgs.coreutils}/bin/cat "${config.secrets.enablek8s.file}")
    if [ "$ENABLEK8S" != "true" ]; then
      ${pkgs.coreutils}/bin/echo "Kubernetes not enabled"
      exit 0
    fi

    if ${pkgs.procps}/bin/pgrep -f "k3s agent" >/dev/null; then
      ${pkgs.coreutils}/bin/echo "k3s agent already running"
      exit 0
    fi

    K8S_TOKEN=$(${pkgs.coreutils}/bin/cat ${config.secrets.k8stoken.file})
    ${pkgs.coreutils}/bin/echo "Joining Kubernetes cluster..."
    exec ${pkgs.k3s}/bin/k3s agent \
      --server https://${managerIp}:6443 \
      --token "$K8S_TOKEN" \
      #--docker \
      #--node-name $(${pkgs.coreutils}/bin/hostname) \
      #--with-node-id
  '';

  # Kubernetes monitor script
  k8sMonitorScript = pkgs.writeShellScript "k8s-monitor" ''
    #!/bin/sh
    set -e

    ENABLEK8S=$(${pkgs.coreutils}/bin/cat "${config.secrets.enablek8s.file}")
    if [ "$ENABLEK8S" != "true" ]; then
      exit 0
    fi

    MAX_ATTEMPTS=8
    ATTEMPT_INTERVAL=22.5  # 180 seconds total / 8 attempts = 22.5s between attempts
    ATTEMPT=1

    while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
      if ${pkgs.procps}/bin/pgrep -f "k3s agent" >/dev/null; then
        ${pkgs.coreutils}/bin/echo "k3s agent is running (attempt $ATTEMPT/$MAX_ATTEMPTS)"
        ${pkgs.coreutils}/bin/sleep $ATTEMPT_INTERVAL
        continue
      fi

      ${pkgs.coreutils}/bin/echo "k3s agent not running, attempting to restart (attempt $ATTEMPT/$MAX_ATTEMPTS)..."
      ${pkgs.systemd}/bin/systemctl restart k8s-join

      # Wait before next check
      ${pkgs.coreutils}/bin/sleep $ATTEMPT_INTERVAL
      ATTEMPT=$((ATTEMPT+1))
    done

    if ! ${pkgs.procps}/bin/pgrep -f "k3s agent" >/dev/null; then
      ${pkgs.coreutils}/bin/echo "Failed to start k3s agent after $MAX_ATTEMPTS attempts"
      exit 1
    fi
  '';
in
{

  services.kubernetes.addons.dns.coredns = {
    imageName = "coredns/coredns";
    imageDigest = "sha256:a0ead06651cf580044aeb0a0feba63591858fb2e43ade8c9dea45a6a89ae7e5e";
    finalImageTag = "1.10.1";
    arch = pkgs.go.GOARCH;
    hash =
      if pkgs.go.GOARCH == "amd64" then
        "sha256-wYMJV/rtUDQXUq5W5WaxzTLrYPtCiVIOVbVqIJJJ5nE="
      else if pkgs.go.GOARCH == "arm64" then
        "sha256-yXkgJW2SQcAFzjmBSAn2qo6O4m5AgMKwiT/LR+dqmzA="
      else
        builtins.throw "Unsupported arch ${pkgs.go.GOARCH}.";
  };
  services.openiscsi = {
        enable = true;
        name = "extranuc";
  };
  services.tailscale = {
        enable = true;
        useRoutingFeatures = "both";
        package = pkgs.callPackage ./tailscale.nix {};
  };
  # Enable OpenSSH server
  services.openssh = {
    enable = true;
    settings = {
      Port = 3060;
      PermitRootLogin = "no";
      PasswordAuthentication = false;
    };
    openFirewall = true;
    extraConfig = ''
      AllowUsers spiderunderurbed
    '';
  };

  netsecrets.client = {
    enable = true;
    server = "192.168.68.77";
    port = 8081;
    password = "your_password";
    request_secrets = [
      "enableswarm"
      "enablek8s"
      "dockerswarm"
      "k8stoken"
    ];
    verbose = true;
  };

  environment.etc."nixos/smb-credentials" = {
    text = credentialsContent;
    mode = "0600";
    user = "root";
    group = "root";
  };

  systemd.tmpfiles.rules = [
    "f /tmp/sync-jellyfin-flag 0644 spiderunderurbed users - -"
    "d /mnt/media 0775 root users -"
    "d /var/lib/calico 0755 root root -"
    "f /var/lib/calico/mtu 0644 root root - 1480"
    "f /var/lib/calico/nodename 0644 root root - extranuc"
  ];

  systemd.services = {
    mount-samba-share = {
      description = "Mount Samba Share";
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      path = [ pkgs.coreutils ];
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
        ExecStart = mountScript;
        ExecStop = "${pkgs.cifs-utils}/bin/umount ${mountPoint}";
      };
      wantedBy = [ "multi-user.target" ];
    };

    sync-jellyfin-directories = {
      description = "Sync Jellyfin config and cache directories";
      after = [ "mount-samba-share.service" ];
      path = with pkgs; [ coreutils unison ];
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
        Environment = "HOME=/home/spiderunderurbed";
        User = "spiderunderurbed";
        Group = "users";
        ExecStart = "${syncScript}";
      };
      wantedBy = [ "multi-user.target" ];
    };

    sync-jellyfin-daemon = {
      description = "Jellyfin Sync Daemon";
      after = [ "sync-jellyfin-directories.service" ];
      wants = [ "sync-jellyfin-directories.service" ];
      serviceConfig = {
        Type = "simple";
        Environment = "HOME=/home/spiderunderurbed";
        User = "spiderunderurbed";
        Group = "users";
        ExecStart = "${syncDaemon}";
        Restart = "always";
        RestartSec = "10s";
      };
      wantedBy = [ "multi-user.target" ];
    };

    docker-swarm-join = {
      description = "Join Docker Swarm Cluster";
      after = [ "network.target" "docker.service" "netsecrets-receiver.service" ];
      wants = [ "network.target" "docker.service" "netsecrets-receiver.service" ];
      serviceConfig = {
        Type = "simple";
        ExecStart = "${dockerSwarmJoinScript}";
        Restart = "on-failure";
        RestartSec = "10s";
        StartLimitIntervalSec = "60";
        StartLimitBurst = "3";
      };
      wantedBy = [ "multi-user.target" ];
    };

    docker-swarm-monitor = {
      description = "Monitor Docker Swarm Status";
      after = [ "docker-swarm-join.service" ];
      wants = [ "docker-swarm-join.service" ];
      serviceConfig = {
        Type = "simple";
        ExecStart = "${dockerSwarmMonitorScript}";
        Restart = "always";
        RestartSec = "30s";
      };
      wantedBy = [ "multi-user.target" ];
    };

    k8s-join = {
      description = "Join Kubernetes Cluster";
      after = [ "network.target" "netsecrets-receiver.service" ];
      wants = [ "network.target" "netsecrets-receiver.service" ];
      serviceConfig = {
        Type = "simple";
        ExecStart = "${k8sJoinScript}";
        Restart = "on-failure";
        RestartSec = "10s";
        StartLimitIntervalSec = "60";
        StartLimitBurst = "3";
      };
      wantedBy = [ "multi-user.target" ];
    };

    k8s-monitor = {
      description = "Monitor Kubernetes Agent Status";
      after = [ "k8s-join.service" ];
      wants = [ "k8s-join.service" ];
      serviceConfig = {
        Type = "simple";
        ExecStart = "${k8sMonitorScript}";
        Restart = "always";
        RestartSec = "30s";
      };
      wantedBy = [ "multi-user.target" ];
    };
  };

  virtualisation.containerd.enable = true;
  virtualisation.docker.enable = true;

  #networking.extraDhcpOptions = {
  #  "${pkgs.ethtool} -K eth0 rx-udp-gro-forwarding on rx-gro-list off"
  #};
  networking.nameservers = [
        #"10.90.0.10"
        "8.8.8.8"
        "8.8.4.4"
  ];
  networking.defaultGateway = {
    address = "192.168.68.1";
    interface = "eth0";
  };
  networking.interfaces.eth0.ipv4.addresses = [ {
    address = "192.168.68.38";
    prefixLength = 24;
  } ];
  networking.firewall = {
    interfaces."eth0" = {
      allowedTCPPorts = [
        3060 22 6443 80 443 30080
        # cilium stuff

        2379 2380 4240 4244 4245 4250 4251 6060 6061 6062
        9878 9879 9890 9891 9893 9901 9962 9963 9964
        #4240 4240 4245 4245 4251 6060
        #6061 6062 9878 9879 9890 9891
        #9893 9901 9962 9963 9964 51871
      ];
      allowedUDPPorts = [
        8472 51871
      ];
      #allowedICMPTypes = [8];
    };
  };

  networking.hostName = "extranuc";

  users.users.spiderunderurbed = {
    password = "test";
    isNormalUser = true;
    openssh.authorizedKeys.keys = [
      (builtins.readFile ./id_rsa.pub)
      (builtins.readFile ./id_ed25519.pub)
    ];
    extraGroups = [ "wheel" "users" "docker" ];
  };

  boot.kernelPackages = pkgs.linuxPackages_latest;
  boot.supportedFilesystems = [ "nfs" ];

  environment.systemPackages = with pkgs; [
    #python3
    git htop sqlite wget gawk util-linux curl fastfetch bash
    kubectl jq coreutils nfs-utils samba openiscsi ncdu
    cifs-utils tailscale lsof tmux screen k3s kubernetes
    specialArgs.netsecrets.packages.${system}.netsecrets
    docker docker-compose unison inotify-tools procps
  ];
}