{ vars, ... }:

{
  imports = [
    (import ../../modules/beszel/host-token.nix {
      name = "nix-cache";
      sopsFile = ../../secrets/nix-cache.yaml;
    })
    (import ../../modules/ipa/client.nix {
      keytabSopsFile = ../../secrets/nix-cache.keytab;
      caCertFile = ../../certs/ipa-ca.crt;
    })
  ];

  networking = {
    hostName = vars.nixCacheHost;
    domain = vars.homeDomain;
    useDHCP = false;
    interfaces.${vars.lxcLanInterface}.ipv4.addresses = [{
      address = vars.nixCacheIp;
      prefixLength = vars.lanPrefixLength;
    }];
    defaultGateway = { address = vars.lanGateway; interface = vars.lxcLanInterface; };
    nameservers = [ vars.domainControllerIp ];
  };

  services.beszel.agent.environment = {
    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
  };

  # Preserved from the pre-refactor `nix-cache` target — stateVersion must
  # never be bumped on an already-installed machine.
  system.stateVersion = "25.05";
}