{ config, pkgs, ... }:

{

  programs = {
    gnupg.agent = {
      enable = true;
      enableSSHSupport = true;

    };
  };

  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  networking = {
    hostName = "TobServer";

    useDHCP = false;
    useNetworkd = true;

    interfaces.eno1.ipv4.addresses = [
      {
        address = "162.55.103.218";
        prefixLength = 26;
      }
    ];

    defaultGateway = {
      address = "162.55.103.193";
      interface = "eno1";
    };

    nameservers = [
      "185.12.64.1"
      "185.12.64.2"
    ];

    firewall = {
      enable = true;
      allowedTCPPorts = [ 22 80 443 50001 ];
    };
  };

  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG3PPXoEV1gt1tR4MyfR3nn1ttzZ4kGTiNfj8703MJdm hetzner-nixos"
  ];

  services = {
    openssh.enable = true;
    openssh.settings.PermitRootLogin = "no";

    btrfs.autoScrub.enable = true;

    protonmail-bridge = {
      enable = true;
    };

    nginx = {
      enable = true;
    };
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "tobias.ostner@proton.me";
  };

  time.timeZone = "Europe/Berlin";

  boot.loader.grub.enable = true;
  boot.loader.grub.device = "/dev/nvme0n1";

  environment.systemPackages = with pkgs; [
    age
    btop
    ffmpeg
    gnupg
    jq
    pass
    ripgrep
    sops
    vim
  ];

  programs.git = {
    enable = true;

    config = {
      user.name = "Tobias Ostner";
      user.email = "tobias.ostner@gmail.com";
    };
  };

  system.stateVersion = "25.11";

  users.users.tobi = {
    isNormalUser = true;
    extraGroups = [ "wheel" "networkmanager" "podman" "bitcoind-mainnet" ];
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG3PPXoEV1gt1tR4MyfR3nn1ttzZ4kGTiNfj8703MJdm hetzner-nixos"
    ];
  };

  security.sudo.enable = true;
  security.sudo.wheelNeedsPassword = false;

  virtualisation.docker.enable = false;

  virtualisation.podman = {
    enable = true;
    dockerCompat = true;
    defaultNetwork.settings.dns_enabled = true;
  };

  sops = {
    defaultSopsFile = ./secrets/tobserver.yaml;
    defaultSopsFormat = "yaml";
    age.keyFile = "/var/lib/sops-nix/key.txt";
  };
}