{ flake, self, inputs }: 
{ pkgs, modulesPath, lib, config, ... }: let
  system       = pkgs.system;
  ipDevice     = "eth0";
  prefixLength = 21; # 255.255.248.0
  vmIp         = "107.189.23.52";
  vmGateway    = "107.189.16.1";
  device       = "/dev/vda";
in {
  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
    inputs.util.nixosModules.hectic
    inputs.sops-nix.nixosModules.sops
    self.nixosModules.vproxy-bot
    inputs.disko.nixosModules.disko
  ];

  boot.loader.systemd-boot.enable = false;
  boot.loader.efi.canTouchEfiVariables = false;
  
  boot.loader.grub = {
    enable = true;
    device = "/dev/vda";
    efiSupport = false;
    forceInstall = true;
  };

  disko.devices.disk.main = {
    device = device;
    type = "disk";
    content = {
      type = "gpt";
      partitions = {
        ESP = {
          size = "512M";
          type = "EF00";
          content = {
            type = "filesystem";
            format = "vfat";
            mountpoint = "/boot";
            mountOptions = [ "umask=0077" ];
          };
        };
        root = {
          size = "100%";
          content = {
            type = "filesystem";
            format = "ext4";
            mountpoint = "/";
          };
        };
      };
    };
  };

  networking.useDHCP = false;
  networking.interfaces.${ipDevice} = {
    ipv4.addresses = [
      { address = vmIp; prefixLength = prefixLength; }
    ];
  };
  networking.defaultGateway = vmGateway;
  networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];

  hectic.archetype.dev.enable = true;

  boot.initrd.availableKernelModules = [
    "ata_piix"
    "uhci_hcd"
    "xen_blkfront"
  ] ++ (if pkgs.system != "aarch64-linux" then [ "vmw_pvscsi" ] else []);

  sops = {
    gnupg.sshKeyPaths = [ ];
    age.sshKeyPaths   = [ "/etc/ssh/ssh_host_ed25519_key" ];
    defaultSopsFile   = ../../../sus/staging.services.env.yaml;

    secrets."vproxy-bot.env"              = {};
  };


  environment.sessionVariables.SYSTEMD_PAGER = "${pkgs.hectic.nvim-pager}/bin/pager";

  banned.services = {
    vproxy-bot = {
      enable          = true;
      websiteDomain   = "vproxy.cc";
      redisPort       = 7021;
      redisGetProxyDb = 1;
      redisPurchaseDb = 2;
      redisMasterDb   = 3;
      environmentPath = config.sops.secrets."vproxy-bot.env".path;
    };
  };

  programs.git = { enable = true; };

  environment.systemPackages = (with pkgs; [ 
    # for system instalation in case when neccesary
    parted

    # tools
    ncdu
    curl
    rsync
    neovim
    lsof
    openssl
    pkg-config
  ]) ++ [
      (self.lib.rustToolchain system)
  ];

  # NOTE: Autologin root in the VM
  services.getty.autologinUser = "root";

  services.openssh.hostKeys = [
    { path = "/etc/ssh/ssh_host_ed25519_key"; type = "ed25519"; }
    { path = "/etc/ssh/ssh_host_rsa_key"; type = "rsa"; bits = 4096; }
  ];
  services.openssh.settings.PasswordAuthentication = lib.mkForce true;

  users.users.root.openssh.authorizedKeys.keys = [
    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsYIQVwnVi/zoqHvuXNXb9qcGsv9q3rY7z7gHmLPfI4''
  ];

  networking.firewall = {
    enable = true;
    allowedTCPPorts = [ 443 80 4000 53 ];
  };

  system.stateVersion = lib.mkForce "24.05";
}
