{ pkgs, lib, config, ... }:
let
  inherit (config) networking;
  inherit (config.services) tor;
  inherit (config.users) users;
  inherit (config.security) gnupg;
  ports = lib.flatten (map (map (p: p.port)) [tor.settings.ORPort tor.settings.DirPort]);
  onion = "5spcvlzbaxwo4knhwnrekjtnakxmvekmlc5qwsigi33rn45hd5gewlyd";
in
{
environment.systemPackages = [
  #pkgs.pythonPackages.stem
  pkgs.nyx
];
networking.nftables.ruleset = ''
  add rule inet filter fw2net meta skuid ${users.tor.name} meta l4proto tcp counter accept comment "Tor"
'' + lib.optionalString (ports != []) ''
  add rule inet filter net2fw tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "Tor"
'';
#security.gnupg.secrets."tor/auth/julm" = {};
security.gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key" = {};
services.tor = {
  enable = true;
  enableGeoIP = true;
  controlSocket.enable = true;
  client.enable = true;
  relay.enable = false;
  relay.role = "private-bridge";
  #client.privoxy.enable = false;
  relay.onionServices = {
    "ssh/${networking.domain}/${networking.hostName}" = {
      secretKey = gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
      map = [ 22 ];
      /*
      authorizedClients = [
        "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
      ];
      */
      settings = {
        #HiddenServiceNumIntroductionPoints = 20;
      };
    };
  };
  settings.ORPort = [
    #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
    { port = 2222; IPv4Only = false; }
    #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
  ];
  settings.BandwidthRate = 500000;
  settings.ReducedExitPolicy = true;
  settings.ExitPolicy = [
    # irc.freenode.net
    "reject 185.30.166.38"
    "reject 185.30.166.37"
    "reject 38.229.70.22"
    "reject 130.185.232.126"
    "reject 185.191.225.10"
    "reject [2a01:7e00::f03c:91ff:fee2:413b]"
    "reject [2001:6b0:e:2a18::119]"
    "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
  ];
  /*
  settings.TransPort = { port = 9040; };
  settings.DNSPort = { port = 9053; };
  #settings.ExtORPort = lib.mkForce null;
  settings.AutomapHostsOnResolve = true;
  */
};

boot.initrd.secrets = {
  "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" =
    gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
};
boot.initrd.extraUtilsCommands = ''
  copy_bin_and_libs ${pkgs.tor}/bin/tor
'';
boot.initrd.network.postCommands = let
  torRc = pkgs.writeText "tor.rc" ''
    DataDirectory /var/lib/tor
    HiddenServicePort 22 127.0.0.1:2222
    HiddenServiceDir /var/lib/tor/onion/ssh
  '';
  in ''
  echo "tor: preparing onion folder"
  # have to do this otherwise tor does not want to start
  install -d -m 700 /var/lib/tor

  echo "make sure localhost is up"
  ip addr add 127.0.0.1/8 dev lo
  ip link set lo up

  echo "tor: starting tor"
  tor -f ${torRc} --verify-config
  tor -f ${torRc} &
'';
}