{ pkgs, lib, nodes, ... }:
let
  ip_pub    = "193.1.99.72";
  ip_priv   = "172.20.20.1";
  hostname  = "agentjones.skynet.ie";

in {
  imports = [
    # applications for this particular server
    ../applications/firewall.nix
  ];

  deployment = {
    targetHost = hostname;
    targetPort = 22;
    targetUser = "root";
  };

  # this has to be defined for any physical servers
  # vms are defined by teh vm host
  networking.interfaces = {
    eth0 = {
      ipv4.addresses = [
        {
          address = "${ip_pub}/32";
          prefixLength = 24;
        }
      ];
    };
    priv0 = {
      ipv4.addresses = [
        {
          address = "${ip_priv}/32";
          prefixLength = 24;
        }
      ];
    };
  };

  # this server is teh firewall
  skynet_firewall = {
    # always good to know oneself

    own = {
      ip = ip_pub;

      ports = {
        tcp = [
          # ssh in
          22
        ];
        udp = [];
      };
    };

    enable = true;

    # gonna have to get all the
    forward = builtins.concatLists (
      # using this function "(key: value: value.config.skynet_firewall.forward)" turn the values ointo a list
      lib.attrsets.mapAttrsToList (key: value:
        # make sure that anything running this firewall dosent count (recursion otherewise)
        # firewall may want to open ports in itself but can deal with that later
        if value.config.skynet_firewall.enable
        then []
        else value.config.skynet_firewall.forward
      ) nodes
    );
  };

}