{ inputs, pkgs, lib, config, ... }:

{

  services.dnsmasq.settings.cname = [ "zigbee2mqtt.home.ctu.cx, home.ctu.cx" ];

  age.secrets = {
    "zigbee2mqtt-htpasswd" = {
      file  = ./. + "/../../../secrets/${config.networking.hostName}/zigbee2mqtt/htpasswd.age";
      owner = "nginx";
    };
    "zigbee2mqtt-secrets.yaml" = {
      file  = ./. + "/../../../secrets/${config.networking.hostName}/zigbee2mqtt/secrets.age";
      owner = "zigbee2mqtt";
    };
  };

  systemd.services.zigbee2mqtt = {
    requires      = [ "mosquitto.service" ];
    after         = [ "mosquitto.service" ];
    onFailure     = [ "email-notify@%i.service" ];
    serviceConfig = {
      Restart       = lib.mkForce "always";
      RuntimeMaxSec = "1d";
    };
  };

  services = {
    udev.extraRules = ''
      SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{serial}=="00_12_4B_00_25_9B_C1_FC", SYMLINK+="zigbee0"
      ATTR{idVendor}=="0451", ATTR{idProduct}=="16a8", ENV{ID_MM_DEVICE_IGNORE}="1"
      SUBSYSTEM=="tty", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="16a8", SYMLINK+="zigbee0"
    '';

    nginx = {
      enable = true;
      virtualHosts."zigbee2mqtt.${config.networking.domain}" = {
        enableACME = lib.mkIf config.networking.usePBBUplink true;
        forceSSL   = lib.mkIf config.networking.usePBBUplink true;
        kTLS       = lib.mkIf config.networking.usePBBUplink true;
        locations."/" = {
          proxyPass       = "http://[::1]:${toString config.services.zigbee2mqtt.settings.frontend.port}";
          proxyWebsockets = true;
          extraConfig     = ''
            auth_basic           Auth;
            auth_basic_user_file ${config.age.secrets.zigbee2mqtt-htpasswd.path};
          '';
        };
      };
    };

    zigbee2mqtt = {
      enable   = true;
      package  = pkgs.zigbee2mqtt;
      settings = {
        homeassistant = false;
        permit_join   = false;

        mqtt = {
          base_topic = "zigbee2mqtt";
          server     = "mqtt://[::1]";
        };

        serial = {
          port        = "/dev/zigbee0";
          disable_led = true;
        };

        frontend = {
          port = 8422;
          host = "::1";
        };

        advanced = {
          log_level   = "info";
          log_output  = [ "console" ];
          channel     = 26;
          network_key = "!${config.age.secrets."zigbee2mqtt-secrets.yaml".path} network_key";
        };

        device_options.retain = true;
        devices = {
          "0x84fd27fffe6b9ddd".friendly_name = "ikea_lamp_hallway";
          "0x94deb8fffe52e639".friendly_name = "ikea_lamp_rgb";
          "0x84fd27fffe44369e".friendly_name = "ikea_lamp_sleepingroom";
          "0x84fd27fffea515fc".friendly_name = "ikea_lamp_livingroom";

#          "0x804b50fffe42a74e".friendly_name = "ikea_remote_l_door";
#          "0x842e14fffe977bfa".friendly_name = "ikea_remote_l_bed";

          "0xa4c138da0f6d23de".friendly_name = "tuya_led_stripe_desk";

          "0xa4c1389d5f391891".friendly_name = "tuya_sensor_fridge";
          "0xa4c13809f76bcdc2".friendly_name = "tuya_sensor_bathroom";
          "0xa4c13882b76fa1ac".friendly_name = "tuya_sensor_sleepingroom";
          "0xa4c138ebeae2efd2".friendly_name = "tuya_sensor_l2";
        };

      };
    };
  };
}