{ config, pkgs, lib, ... }:

with lib;

let
  cfg = config.services.naxos.core;
in {
  options.services.naxos.core = {
    enable = mkEnableOption "NaxOS Core Appliance Base";

    hostName = mkOption {
      type = types.str;
      default = "naxos";
      description = "Appliance hostname.";
    };

    hostId = mkOption {
      type = types.str;
      default = "8425f3a1";
      description = "32-bit Host ID required for OpenZFS safety locking.";
    };

    timeZone = mkOption {
      type = types.str;
      default = "Europe/Berlin";
      description = "System timezone.";
    };
  };

  config = mkIf cfg.enable {
    networking.hostName = cfg.hostName;
    networking.hostId = cfg.hostId;
    time.timeZone = cfg.timeZone;

    # Flakes and Nix CLI enablement
    nix.settings = {
      experimental-features = [ "nix-command" "flakes" ];
      auto-optimise-store = true;
    };

    # High-Performance Storage & Network Kernel Tuning
    boot.kernel.sysctl = {
      # BBR Congestion Control
      "net.core.default_qdisc" = "fq";
      "net.ipv4.tcp_congestion_control" = "bbr";

      # High-bandwidth 10G/25G network buffer tuning
      "net.core.rmem_max" = 67108864;
      "net.core.wmem_max" = 67108864;
      "net.ipv4.tcp_rmem" = "4096 87380 33554432";
      "net.ipv4.tcp_wmem" = "4096 65536 33554432";
      "net.core.netdev_max_backlog" = 10000;

      # Storage & VM writeback tuning for ZFS
      "vm.swappiness" = 10;
      "vm.dirty_background_ratio" = 5;
      "vm.dirty_ratio" = 10;

      # File handles limit
      "fs.file-max" = 2097152;
    };

    # Core system tools
    environment.systemPackages = with pkgs; [
      curl
      wget
      git
      htop
      btop
      tmux
      jq
      pciutils
      usbutils
      ethtool
      iperf3
      rsync
    ];

    # Security & Firewall defaults
    networking.firewall = {
      enable = true;
      allowPing = true;
      allowedTCPPorts = [ 22 80 443 ];
    };

    # SSH Server with modern secure defaults
    services.openssh = {
      enable = true;
      settings = {
        PermitRootLogin = "prohibit-password";
        PasswordAuthentication = false;
        KbdInteractiveAuthentication = false;
      };
    };
  };
}