{ pkgs, vars, ... }:

{
  # Pins the Docker Engine version, carried forward from the pre-refactor
  # `docker` target's inline pkgs overlay.
  nixpkgs.overlays = [
    (final: prev: {
      docker = prev.docker_29;
      docker_cli = prev.docker_29;
    })
  ];

  imports = [
    ../docker/mount-data.nix
    ../docker/enable-service.nix
    ../docker/nextcloud-cron-job.nix
    ../docker/docker-health-to-gotify.nix
    ../tailscale/enable-service.nix
    ../traefik/rotate-logs.nix
    ../raspi/mount-data.nix
    ../services/enable-rpcbind.nix
  ];

  environment.systemPackages = with pkgs; [
    nfs-utils
  ];

  boot.supportedFilesystems = [ "nfs" ];

  systemd.tmpfiles.rules = [
    "L+ /home/${vars.primaryUser}/docker - - - - ${vars.nfsShares.dockerConfig.mountpoint}"
    "d /mnt/docker 0755 ${vars.primaryUser} users -"
    "d ${vars.nfsShares.raspiVolumes.mountpoint} 0755 ${vars.primaryUser} users -"
  ];

  users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
  services.openssh.settings.PermitRootLogin = "yes";

  networking.firewall.allowedTCPPorts = [
    vars.ports.dockerHttp
    vars.ports.dockerExtra
    vars.ports.dockerHttps
    vars.ports.beszelHub
  ];
}