{ config, lib, pkgs, ... }:

let
  # n97-1 Tailscale IP — update after initial Tailscale auth
  tailscaleIP = "100.x.x.x";
in {
  imports = [
    ../modules/meos-gateway.nix
  ];

  networking.hostName = "n97-1";

  # ── k3s server (single-node control plane) ──
  services.k3s-cluster = {
    enable = true;
    role = "server";
    tailscaleIP = tailscaleIP;
    tokenFile = "/var/lib/k3s/cluster-token";
  };

  # ── Gateway (nginx + ACME) ──
  services.meos-gateway = {
    enable = true;
    tailscaleIP = tailscaleIP;
  };

  # ── PostgreSQL (for Forgejo + Umami, transition to K8s) ──
  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_17;
    extraPlugins = [ pkgs.postgresql_17.pkgs.pgvector ];
    dataDir = "/data/postgresql";
  };

  # ── Forgejo (bare metal during transition, then K8s) ──
  services.forgejo = {
    enable = true;
    database.type = "postgres";
    database.name = "forgejo";
    database.user = "forgejo";
    settings.server.ROOT_URL = "https://os.scoble.me/forgejo/";
    lfs.enable = true;
  };

  # ── OpenClaw gateway stays bare metal ──
  # (managed separately via systemd user service)

  # ── Firewall ──
  networking.firewall = {
    enable = true;
    trustedInterfaces = [ "tailscale0" ];
    allowedTCPPorts = [ 80 443 6443 ];
  };

  # ── User ──
  users.users.sscoble = {
    isNormalUser = true;
    extraGroups = [ "wheel" "docker" ];
  };

  security.sudo.extraRules = [{
    users = [ "sscoble" ];
    commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
  }];

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  nix.settings.trusted-users = [ "sscoble" ];
}