{ config, pkgs, vars, ... }:

{
  # nix-serve's signing key has to be the *same* key on every host that
  # ever plays the nix-cache role -- modules/nix-cache/client.nix hardcodes
  # every client's trust in one specific public key ("cache.local-1:..."),
  # so a freshly self-generated key here wouldn't be trusted by anyone.
  # Managed via sops-nix like every other secret in this repo instead of
  # the old manual `nix-store --generate-binary-cache-key` step -- see
  # "Binary cache signing key" in docs/nix-cache.md for how to add/rotate
  # the value in secrets/nix-cache.yaml.
  sops.secrets."cache-priv-key".sopsFile = ../../secrets/nix-cache.yaml;

  services = {
    nix-serve = {
      enable = true;
      secretKeyFile = config.sops.secrets."cache-priv-key".path;
    };

    nginx = {
      enable = true;
      recommendedProxySettings = true;
      virtualHosts."${vars.nixCacheHost}.${vars.homeDomain}" = {
        locations."/" = {
          proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
        };
      };
    };

    openssh.enable = true;
  };

  networking.firewall.allowedTCPPorts = [ vars.ports.nixCacheHttp ];

  users.groups.${vars.remoteBuilderUser} = { };

  users.users.${vars.remoteBuilderUser} = {
    isSystemUser = true;
    group = vars.remoteBuilderUser;
    createHome = true;
    home = "/var/lib/nixremote";
    shell = pkgs.bashInteractive;
    # Client public keys allowed to use this host as a remote builder —
    # single source of truth is vars.remoteBuilderAuthorizedKeys (safe to
    # commit public keys only).
    openssh.authorizedKeys.keys = vars.remoteBuilderAuthorizedKeys;
  };

  nix.settings = {
    trusted-users = [ "root" vars.remoteBuilderUser ];
    experimental-features = [ "nix-command" "flakes" ];
    auto-optimise-store = true;
    builders-use-substitutes = true;
  };

  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than ${vars.nixCacheGcMaxAge}";
  };
}