{ pkgs, lib, ... }: {
  imports = [
    ../../templates/proxmox-lxc.nix
    ../../server.nix
    ../../features/dns-cache.nix
    ../../features/telemetry
  ];

  networking.hostName = "nas0";
  system.stateVersion = "24.05";
  nixpkgs.hostPlatform = "x86_64-linux";

  networking.firewall.enable = true;
  networking.firewall.allowPing = true;
  networking.firewall.extraCommands = ''iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns'';

  users.groups.data = {
    gid = 994;
  };
  users.users.data = {
    uid = 1001;
    isNormalUser = true;
    group = "data";
  };

  services.samba = {
    enable = true;
    # package = pkgs.samba4Full;
    openFirewall = true;
    settings.global = {
      "workgroup" = "WORKGROUP";
      "security" = "user";
      "server string" = "nas0";
      "netbios name" = "nas0";
      "hosts allow" = "10.0.0.0/8 100.64.0.0/10 127.0.0.1 localhost";
      "hosts deny" = "0.0.0.0/0";
      "server min protocol" = "SMB2";
    };
    shares."main" = {
      path = "/mnt/storage/main";
      browseable = "yes";
      writable = "true";
      "guest ok" = "no";
      "create mask" = "0644";
      "directory mask" = "0755";
      "force user" = "data";
      "force group" = "data";
    };
    shares."pub" = {
      path = "/mnt/storage/main/public";
      browseable = "yes";
      writable = "false";
      "guest ok" = "yes";
    };
  };

  # Advertise to local Windows hosts
  services.samba-wsdd = {
    enable = true;
    openFirewall = true;
  };

  # mDNS advertisement
  services.avahi = {
    enable = true;
    openFirewall = true; 
    nssmdns4 = true;
    publish = {
      enable = true;
      addresses = true;
      domain = true;
      hinfo = true;
      userServices = true;
      workstation = true;
    };
    extraServiceFiles = {
      smb = ''
        <?xml version="1.0" standalone='no'?><!--*-nxml-*-->
        <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
        <service-group>
          <name replace-wildcards="yes">%h</name>
          <service>
            <type>_smb._tcp</type>
            <port>445</port>
          </service>
        </service-group>
      '';
    };
  };

  # WebDAV anonymous reads
  services.webdav-server-rs = {
    enable = true;
    user = "data";
    group = "data";
    settings = {
      server.listen = [ "0.0.0.0:6969" "[::]:6969" ];
      location = [
        {
          route = [ "/public(/*path)" ];
          directory = "/mnt/storage/main/public";
          handler = "filesystem";
          methods = [ "webdav-ro" ];
          autoindex = true;
          auth = "false";
        }
        {
          route = [ "/s(/*path)" ];
          directory = "/mnt/storage/main/public/Share";
          handler = "filesystem";
          methods = [ "webdav-ro" ];
          autoindex = true;
          auth = "false";
        }
      ];
    };
  };

  fileSystems."/export/storage" = {
    device = "/mnt/storage/main";
    options = [ "bind" ];
  };

  # NFS is banned from the dollhouse due to inappropriate proxmox behavior :c
  services.nfs.server = {
    enable = true;
    exports = let
      ipList = [
        "10.0.0.0/8" # home net
        "2600:1700:5890:ee2f::/64" # home net6
        "100.64.0.0/10" # tailnet
        "fd7a:115c:a1e0::/48" # tailnet6
      ];
      ipRule = rule: lib.strings.concatMapStrings (ip: "${ip}(${rule}) ") ipList;
    in ''
      /export         ${ipRule "rw,insecure,fsid=0,no_subtree_check"}
      /export/storage ${ipRule "rw,insecure,nohide,no_subtree_check"}
    '';
  };

  networking.firewall.allowedTCPPorts = [ 2049 6969 ];
  networking.firewall.allowedUDPPorts = [ 2049 ];
}
