{ pkgs, lib, config, ... }:
let
  inherit (config) networking;
  inherit (config.services) tor;
  inherit (config.users) users;
  ports = lib.flatten (map (map (p: p.port)) [ tor.settings.ORPort tor.settings.DirPort ]);
  onion = "5spcvlzbaxwo4knhwnrekjtnakxmvekmlc5qwsigi33rn45hd5gewlyd";
in
{
  environment.systemPackages = [
    #pkgs.pythonPackages.stem
    pkgs.nyx
  ];
  networking.nftables.ruleset = lib.optionalString (ports != [ ]) ''
    table inet filter {
      chain input-net {
        tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "tor"
      }
    }
  '' + ''
    table inet filter {
      chain output-net {
        skuid ${users.tor.name} tcp counter accept comment "tor"
      }
    }
  '';
  systemd.services.tor.serviceConfig.LoadCredentialEncrypted = [
    "${onion}.hs_ed25519_secret_key:${./tor + "/${onion}.hs_ed25519_secret_key.cred"}"
  ];
  services.tor = {
    enable = true;
    enableGeoIP = true;
    controlSocket.enable = true;
    client.enable = true;
    client.dns.enable = true;
    relay.enable = false;
    relay.role = "private-bridge";
    #client.privoxy.enable = false;
    relay.onionServices = {
      "ssh/${networking.domain}/${networking.hostName}" = {
        secretKey = "/run/credentials/tor.service/${onion}.hs_ed25519_secret_key";
        map = [ 22 ];
        /*
      authorizedClients = [
        "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
      ];
        */
        settings = {
          #HiddenServiceNumIntroductionPoints = 20;
        };
      };
    };
    settings.AutomapHostsSuffixes = [ ".onion" ];
    settings.ORPort = [
      #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
      { port = 2222; IPv4Only = false; }
      #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
    ];
    settings.BandwidthRate = 500000;
    settings.ReducedExitPolicy = true;
    settings.ExitPolicy = [
      # irc.freenode.net
      "reject 185.30.166.38"
      "reject 185.30.166.37"
      "reject 38.229.70.22"
      "reject 130.185.232.126"
      "reject 185.191.225.10"
      "reject [2a01:7e00::f03c:91ff:fee2:413b]"
      "reject [2001:6b0:e:2a18::119]"
      "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
    ];
    /*
      settings.TransPort = { port = 9040; };
      settings.DNSPort = { port = 9053; };
      #settings.ExtORPort = lib.mkForce null;
      settings.AutomapHostsOnResolve = true;
    */
  };
  /*
    boot.initrd.secrets = {
    "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" =
    gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
    };
    boot.initrd.extraUtilsCommands = ''
    copy_bin_and_libs ${pkgs.tor}/bin/tor
    '';
    boot.initrd.network.postCommands = let
    torRc = pkgs.writeText "tor.rc" ''
    DataDirectory /var/lib/tor
    HiddenServicePort 22 127.0.0.1:2222
    HiddenServiceDir /var/lib/tor/onion/ssh
    '';
    in ''
    echo "tor: preparing onion folder"
    # have to do this otherwise tor does not want to start
    install -d -m 700 /var/lib/tor

    echo "make sure localhost is up"
    ip addr add 127.0.0.1/8 dev lo
    ip link set lo up

    echo "tor: starting tor"
    tor -f ${torRc} --verify-config
    tor -f ${torRc} &
    '';
  */
}