{ config, inputs, lib, outputs, pkgs, ... }:
{
  imports = [
    common/core
  ];

  home.file = {
    "bin/games-fw" = {
      executable = true;
      text = ''
        #!${pkgs.zsh}/bin/zsh

        # load module to parse command line arguments
        zmodload zsh/zutil
        zparseopts -D -E -A opts -- d h l x
        
        # enable XTRACE shell option for full debugging output of scripts
        if (( ''${+opts[-x]} )); then
        	set -x
        fi
        
        if ! (( ''${+opts[-l]} )) && [[ -z "''${1}" ]] || (( ''${+opts[-h]} )); then
        	echo "usage: ''${0:t} [ -h ] [ -x ] { -d handle | -l | cidr }" >&2
        	echo '
        	-d	delete a rule by handle; handle must be specified ( nft -a list ruleset )
        	-h	this message
        	-l	list games chain
        	-x	enable shell debugging
        	cidr	IPv4 host or CIDR network address
        ' >&2
        	exit 1
        fi
        
        function list_games_chain {
        	nft -a list ruleset | sed -ne '/\tchain games {/,/\t}$/p'
        }
        
        if (( ''${+opts[-d]} )); then
        
        	handle="''${1}"
        	rule=$(nft -a list ruleset | grep ' # handle '"''${handle}"'$')
        
        	if [[ -z "''${rule}" ]]; then
        		echo 'no matching handle found!' >&2
        		exit 1
        	else
        
        		nft delete rule inet nixos-fw games handle ''${handle}
        		list_games_chain
        
        	fi
        
        elif (( ''${+opts[-l]} )); then
        
        	list_games_chain
        
        else
        
        	cidr="''${1}"
        	nft insert rule inet nixos-fw games 'ip saddr '"''${cidr}"' counter accept'
        	list_games_chain
        
        fi
        
        exit 0
      ''
    };

    "bin/knock".source = ../common/scripts/knock;

    "bin/vpnctl" = {
      executable = true;
      text = ''
        #!${pkgs.zsh}/bin/zsh

        function status_vpn {

        	ip netns exec vpn su -c 'curl -m 10 -s https://bitgnome.net/ip/ | grep REMOTE_ADDR' nipsy
        	ip netns exec vpn su -c 'curl -m 10 -s https://www.cloudflarestatus.com | grep "Cloudflare Status"' nipsy

        }

        function start_vpn {

        	ip netns add vpn
        	ip link add veth.host type veth peer veth.vpn
        	ip link set dev veth.host up
        	ip link set veth.vpn netns vpn up
        	ip -n vpn address add 192.168.1.3/24 dev veth.vpn
        	ip route add 192.168.1.3/32 dev veth.host
        	ip link add wg1 type wireguard
        	ip link set wg1 netns vpn
        	ip -n vpn -4 address add $(grep ^#Address /run/secrets/wireguard/wg1_conf | cut -d= -f2 | cut -d, -f1 | xargs) dev wg1
        	ip netns exec vpn wg setconf wg1 /run/secrets/wireguard/wg1_conf
        	ip -n vpn link set wg1 up
        	ip -n vpn route add default dev wg1
        	ip netns exec vpn nft -f /etc/nftables-vpn.conf

        }

        function stop_vpn {

        	systemctl stop prowlarr.service qbittorrent.service

        	if ip netns | grep -q '^vpn '; then
                        ip netns del vpn
                fi

        	if ip link show veth.host > /dev/null; then
        		ip link del veth.host
                fi

        }

        if [[ -z "''${1}" || "''${1}" == "status" ]]; then

        	status_vpn

        elif [[ "''${1}" == "restart" ]]; then

        	stop_vpn
        	sleep 2
        	start_vpn
        	systemctl restart prowlarr.service qbittorrent.service

        elif [[ "''${1}" == "restart_firewall" ]]; then

        	ip netns exec vpn nft -f /etc/nftables-vpn.conf

        elif [[ "''${1}" == "start" ]]; then

        	if [[ ! -f /run/netns/vpn ]]; then
        		start_vpn
                else
        		echo 'VPN service already appears to be running' >&2
        	fi

        elif [[ "''${1}" == "stop" ]]; then

        	stop_vpn

        fi

        exit 0
      '';
    };
  };

  nix.extraOptions = ''
    !include /run/secrets/nix-access-token-github
  '';
}