{ inputs, node, secrets, pkgs, lib, config, ... }:

{

  dns.zones."ctu.cx".subdomains."zigbee2mqtt.home".AAAA = [ node.ip6Address ];

  age.secrets."zigbee2mqttSecrets.yaml" = {
    file  = secrets."${config.networking.hostName}".zigbee2mqtt.secrets;
    owner = "zigbee2mqtt";
  };

  systemd.services.zigbee2mqtt = {
    requires      = [ "mosquitto.service" ];
    after         = [ "mosquitto.service" ];
    onFailure     = [ "email-notify@%i.service" ];
    serviceConfig = {
      Restart       = lib.mkForce "always";
      RuntimeMaxSec = "1d";
    };
  };

  services = {
    udev.extraRules = ''
      SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{serial}=="00_12_4B_00_25_9B_C1_FC", SYMLINK+="zigbee0"
      ATTR{idVendor}=="0451", ATTR{idProduct}=="16a8", ENV{ID_MM_DEVICE_IGNORE}="1"
      SUBSYSTEM=="tty", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="16a8", SYMLINK+="zigbee0"
    '';

    nginx = {
      enable = true;
      virtualHosts."zigbee2mqtt.${config.networking.domain}" = {
        useACMEHost = "${config.networking.fqdn}";
        forceSSL    = true;
        kTLS        = true;
        extraConfig = ''
          ssl_crl /etc/ctucxCA.crl;
          ssl_client_certificate ${../../../../secrets/certs/rootCA.crt};
          ssl_verify_client on;
        '';
        locations."/" = {
          proxyPass       = "http://[::1]:${toString config.services.zigbee2mqtt.settings.frontend.port}";
          proxyWebsockets = true;
        };
      };
    };

    zigbee2mqtt = {
      enable   = true;
      package  = pkgs.zigbee2mqtt;
      settings = {
        homeassistant = false;
        permit_join   = false;

        mqtt = {
          base_topic = "zigbee2mqtt";
          server     = "mqtt://[::1]";
        };

        serial = {
          port        = "/dev/zigbee0";
          disable_led = true;
        };

        frontend = {
          port = 8422;
          host = "::1";
        };

        advanced = {
          log_level   = "info";
          log_output  = [ "console" ];
          channel     = 26;
          network_key = "!${config.age.secrets."zigbee2mqttSecrets.yaml".path} network_key";
        };

        device_options.retain = true;
        devices = {
          "0x84fd27fffe6b9ddd".friendly_name = "ikea_lamp_hallway";
          "0x94deb8fffe52e639".friendly_name = "ikea_lamp_rgb";
          "0x84fd27fffe44369e".friendly_name = "ikea_lamp_sleepingroom";
          "0x84fd27fffea515fc".friendly_name = "ikea_lamp_livingroom";

#          "0x804b50fffe42a74e".friendly_name = "ikea_remote_l_door";
#          "0x842e14fffe977bfa".friendly_name = "ikea_remote_l_bed";

          "0xa4c138da0f6d23de".friendly_name = "tuya_led_stripe_desk";

          "0xa4c1389d5f391891".friendly_name = "tuya_sensor_fridge";
          "0xa4c13809f76bcdc2".friendly_name = "tuya_sensor_bathroom";
          "0xa4c13882b76fa1ac".friendly_name = "tuya_sensor_sleepingroom";
          "0xa4c138ebeae2efd2".friendly_name = "tuya_sensor_l2";
        };

      };
    };
  };
}