{ config, pkgs, vars, ... }:

{
  # Generate the binary cache key pair on the nix-cache host:
  #   sudo install -d -m 0700 /etc/nix
  #   sudo nix-store --generate-binary-cache-key nix-cache-1 \
  #     /etc/nix/cache-priv.pem \
  #     /etc/nix/cache-pub.pem
  #   sudo chmod 0600 /etc/nix/cache-priv.pem
  #   sudo chmod 0644 /etc/nix/cache-pub.pem
  #   cat /etc/nix/cache-pub.pem
  services = {
    nix-serve = {
      enable = true;
      secretKeyFile = "/etc/nix/cache-priv.pem";
    };

    nginx = {
      enable = true;
      recommendedProxySettings = true;
      virtualHosts.${vars.nixCacheHost} = {
        locations."/" = {
          proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
        };
      };
    };

    openssh.enable = true;
  };

  networking.firewall.allowedTCPPorts = [ vars.ports.nixCacheHttp ];

  users.groups.${vars.remoteBuilderUser} = { };

  users.users.${vars.remoteBuilderUser} = {
    isSystemUser = true;
    group = vars.remoteBuilderUser;
    createHome = true;
    home = "/var/lib/nixremote";
    shell = pkgs.bashInteractive;
    # Client public keys allowed to use this host as a remote builder —
    # single source of truth is vars.remoteBuilderAuthorizedKeys (safe to
    # commit public keys only).
    openssh.authorizedKeys.keys = vars.remoteBuilderAuthorizedKeys;
  };

  nix.settings = {
    trusted-users = [ "root" vars.remoteBuilderUser ];
    experimental-features = [ "nix-command" "flakes" ];
    auto-optimise-store = true;
    builders-use-substitutes = true;
  };

  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than ${vars.nixCacheGcMaxAge}";
  };
}