/*

  Name:     https://en.wikipedia.org/wiki/Optimus_Prime
  Why:      Created to sell toys so this vm is for games
  Type:     VM
  Hardware: -
  From:     2023
  Role:     Game host
  Notes:

*/

{ pkgs, lib, nodes, arion, ... }:
let
  # name of the server, sets teh hostname and record for it
  name      = "optimus";
  ip_pub    = "193.1.99.112";
  ip_priv   = "172.20.20.7";
  hostname  = "${name}.skynet.ie";

in {
  imports = [
    # applications for this particular server
    ../applications/firewall.nix
    ../applications/dns.nix
    ../applications/games.nix

    # for testing
    ../applications/ldap.nix
  ];

  deployment = {
    targetHost = hostname;
    targetPort = 22;
    targetUser = "root";
  };

  # these two are to be able to add the rules for firewall and dns
  # open the firewall for this
  skynet_firewall.forward = [
    "ip daddr ${ip_pub} tcp dport 80 counter packets 0 bytes 0 accept"
    "ip daddr ${ip_pub} tcp dport 443 counter packets 0 bytes 0 accept"
    "ip daddr ${ip_pub} tcp dport 25565 counter packets 0 bytes 0 accept"
  ];

  skynet_dns.records = {
    external = [
      "${name}       A       ${ip_pub}"
    ];
    cname = [
      # the games are each going to have a subdomain on this
      "games           CNAME   ${name}"
    ];
  };

# we use this to pass in teh relevent infomation to the
  services.skynet_ldap = {
    enable = true;

    host = {
      # pass in teh ip (used for firewall)
      ip = ip_pub;

      # the name is used for dns
      name = name;
    };
  };

  security.sudo.extraRules = [
     { groups = [ "skynet-admins" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; }
  ];

  services.sssd = {
    enable = true;

    sshAuthorizedKeysIntegration = true;

    config = ''
      [domain/skynet.ie]
      debug_level = 4

      id_provider = ldap
      auth_provider = ldap
      sudo_provider = ldap

      ldap_uri = ldap://193.1.99.112:389

      ldap_search_base = dc=skynet,dc=ie
      # thank ye https://medium.com/techish-cloud/linux-user-ssh-authentication-with-sssd-ldap-without-joining-domain-9151396d967d
      ldap_user_search_base = ou=users,dc=skynet,dc=ie?sub?(|(skMemberOf=cn=skynet-users,ou=groups,dc=skynet,dc=ie))
      ldap_group_search_base = ou=groups,dc=skynet,dc=ie
      ldap_sudo_search_base = cn=skynet-admins,ou=groups,dc=skynet,dc=ie

      ldap_group_nesting_level = 5

      cache_credentials = false
      entry_cache_timeout = 1

      ldap_user_member_of = skMemberOf

      [sssd]
      config_file_version = 2
      services = nss, pam, sudo, ssh
      domains = skynet.ie

      [nss]

      [pam]

      [sudo]

      [autofs]
    '';
  };

}