{ config, inputs, lib, outputs, pkgs, ... }:
{
  imports = [
    common/core
  ];

  home.file = {
    "bin/games-fw" = {
      executable = true;
      text = ''
        #!${pkgs.zsh}/bin/zsh

        # load module to parse command line arguments
        zmodload zsh/zutil
        zparseopts -D -E -A opts -- d h l x
        
        # enable XTRACE shell option for full debugging output of scripts
        if (( ''${+opts[-x]} )); then
        	set -x
        fi
        
        if ! (( ''${+opts[-l]} )) && [[ -z "''${1}" ]] || (( ''${+opts[-h]} )); then
        	echo "usage: ''${0:t} [ -h ] [ -x ] { -d handle | -l | cidr }" >&2
        	echo '
        	-d	delete a rule by handle; handle must be specified ( nft -a list ruleset )
        	-h	this message
        	-l	list games chain
        	-x	enable shell debugging
        	cidr	IPv4 host or CIDR network address
        ' >&2
        	exit 1
        fi
        
        function list_games_chain {
        	nft -a list ruleset | sed -ne '/\tchain games {/,/\t}$/p'
        }
        
        if (( ''${+opts[-d]} )); then
        
        	handle="''${1}"
        	rule=$(nft -a list ruleset | grep ' # handle '"''${handle}"'$')
        
        	if [[ -z "''${rule}" ]]; then
        		echo 'no matching handle found!' >&2
        		exit 1
        	else
        
        		nft delete rule inet nixos-fw games handle ''${handle}
        		list_games_chain
        
        	fi
        
        elif (( ''${+opts[-l]} )); then
        
        	list_games_chain
        
        else
        
        	cidr="''${1}"
        	nft insert rule inet nixos-fw games 'ip saddr '"''${cidr}"' counter accept'
        	list_games_chain
        
        fi
        
        exit 0
      '';
    };

    "bin/knock".source = ../common/scripts/knock;

    "bin/vpnctl" = {
      executable = true;
      text = ''
        #!${pkgs.zsh}/bin/zsh

        function status_vpn {

        	ip netns exec vpn su -c 'curl -m 10 -s https://bitgnome.net/ip/ | grep REMOTE_ADDR' nipsy
        	ip netns exec vpn su -c 'curl -m 10 -s https://www.cloudflarestatus.com | grep "Cloudflare Status"' nipsy

        }

        function start_vpn {

                ip netns add vpn
                ip netns exec vpn ip link set lo up
        	ip link add veth.host type veth peer veth.vpn
        	ip link set dev veth.host up
        	ip link set veth.vpn netns vpn up
        	ip -n vpn address add 192.168.1.3/24 dev veth.vpn
        	ip route add 192.168.1.3/32 dev veth.host
        	ip link add wg1 type wireguard
        	ip link set wg1 netns vpn
        	ip -n vpn -4 address add $(grep ^#Address /run/secrets/wireguard/wg1_conf | cut -d= -f2 | cut -d, -f1 | xargs) dev wg1
        	ip netns exec vpn wg setconf wg1 /run/secrets/wireguard/wg1_conf
        	ip -n vpn link set wg1 up
        	ip -n vpn route add default dev wg1
        	ip netns exec vpn nft -f /etc/nftables-vpn.conf

        }

        function stop_vpn {

        	systemctl stop prowlarr.service qbittorrent.service

        	if ip netns | grep -q '^vpn '; then
                        ip netns del vpn
                fi

        	if ip link show veth.host > /dev/null; then
        		ip link del veth.host
                fi

        }

        if [[ -z "''${1}" || "''${1}" == "status" ]]; then

        	status_vpn

        elif [[ "''${1}" == "restart" ]]; then

        	stop_vpn
        	sleep 2
        	start_vpn
        	systemctl restart prowlarr.service qbittorrent.service

        elif [[ "''${1}" == "restart_firewall" ]]; then

        	ip netns exec vpn nft -f /etc/nftables-vpn.conf

        elif [[ "''${1}" == "start" ]]; then

        	if [[ ! -f /run/netns/vpn ]]; then
        		start_vpn
                else
        		echo 'VPN service already appears to be running' >&2
        	fi

        elif [[ "''${1}" == "stop" ]]; then

        	stop_vpn

        fi

        exit 0
      '';
    };
  };

  nix.extraOptions = ''
    !include /run/secrets/nix-access-token-github
  '';
}