{ inputs, lib, ... }:

{
  flake.modules.nixos."nixosConfigurations/home02" =
    { pkgs, ... }:
    {
      imports = with inputs.self.modules.nixos; [
        inputs.agenix.nixosModules.default

        nginx-oliverdavies-uk
        nginx-ponthir-taekwondo
        server-forgejo
      ];

      homelab.services =
        let
          cloudflareTunnelId = "c1537889-81ac-4d41-b80d-9657f8db30c7";
        in
        {
          forgejo = {
            inherit cloudflareTunnelId;

            domain = "git.oliverdavies.uk";
            enable = true;
            sshDomain = "ssh.oliverdavies.uk";
          };
        };

      nix.settings = {
        auto-optimise-store = true;

        experimental-features = [
          "nix-command"
          "flakes"
        ];

        warn-dirty = false;
      };

      age.secrets = {
        cloudflare.file = ../../../../secrets/cloudflare.age;
        cloudflared.file = ../../../../secrets/cloudflared-credentials2.age;
      };

      networking.hostName = "home02";

      system.stateVersion = "25.05";

      boot.loader.efi.canTouchEfiVariables = true;
      boot.loader.systemd-boot.enable = true;

      networking.networkmanager.enable = true;

      time.timeZone = "Europe/London";

      i18n.defaultLocale = "en_GB.UTF-8";

      i18n.extraLocaleSettings = {
        LC_ADDRESS = "en_GB.UTF-8";
        LC_IDENTIFICATION = "en_GB.UTF-8";
        LC_MEASUREMENT = "en_GB.UTF-8";
        LC_MONETARY = "en_GB.UTF-8";
        LC_NAME = "en_GB.UTF-8";
        LC_NUMERIC = "en_GB.UTF-8";
        LC_PAPER = "en_GB.UTF-8";
        LC_TELEPHONE = "en_GB.UTF-8";
        LC_TIME = "en_GB.UTF-8";
      };

      services.xserver.xkb = {
        layout = "gb";
        variant = "";
      };

      console.keyMap = "uk";

      users.users.opdavies = {
        isNormalUser = true;
        description = "Oliver Davies";
        extraGroups = [
          "networkmanager"
          "wheel"
        ];
        packages = [ ];
        shell = pkgs.zsh;
      };

      nixpkgs.config.allowUnfree = true;

      services.openssh.enable = true;

      security.sudo.wheelNeedsPassword = false;

      programs.zsh.enable = true;
      programs.zsh.interactiveShellInit = ''
        clear
        ${lib.getExe pkgs.fastfetch}
      '';

      services.fail2ban.enable = true;
    };
}