{ config, pkgs, ... }:
let
  # ports
  nfs3 = [
    111
    4000
    4001
    4002
    20048
  ];

  nfs4 = [
    2049
  ];
    
  iscsi = [
    3260
  ];

  tcpPorts = nfs3 ++ nfs4 ++ iscsi;
  udpPorts = nfs3;
  # ---

  # iscsi info
  nasBase = "iqn.2026-01.dev.nyxerinys:poseidon";

  initiators = map ( name: {
    node_wwn = "iqn.2026-01.dev.nyxerinys:${name}";
    mapped_luns = [
      {
        index = 0;
        tpg_lun = 0;
        write_protect = false;
      }
    ];
  }) [
    "gamma"
    "delta"
    "epsilon"
  ];

  # initiators = [
  #   { node_wwn = "iqn.2026-01.dev.nyxerinys:gamma"; }
  #   { node_wwn = "iqn.2026-01.dev.nyxerinys:delta"; }
  #   { node_wwn = "iqn.2026-01.dev.nyxerinys:epsilon"; }
  # ];

  targets = [
    { name = "Authentik"; zvol = "Velaris/Containers/Authentik"; lun = 0; }
    { name = "Vaultwarden"; zvol = "Velaris/Containers/Vaultwarden"; lun = 0; }
  ];

in {
  networking.firewall.allowedTCPPorts = tcpPorts;
  networking.firewall.allowedUDPPorts = udpPorts;
  fileSystems = {
    "/export/containers" = {
      device = "/Velaris/Containers";
      fsType = "none";
      options = [ "bind" ];
    };
  };

  systemd.services.iscsi-target = {
    restartTriggers = [
      (builtins.toJSON config.services.target.config)
    ];
    stopIfChanged = false;
  };

  users.users.polycule = {
    isNormalUser = true;
    description = "Polycule";
    extraGroups = [ ];
    packages = with pkgs; [];
  };

  services = {
    samba = {
      enable = true;
      securityType = "user";
      openFirewall = true;
      settings = {
        global = {
          "interfaces" = "127.0.0.1 10.5.0.2"; # Replace with your server's IPv4
          "bind interfaces only" = "yes";
          "workgroup" = "WORKGROUP";
          "server string" = "smbnix";
          "netbios name" = "smbnix";
          "security" = "user";
          #"use sendfile" = "yes";
          #"max protocol" = "smb2";
          # note: localhost is the ipv6 localhost ::1
          "hosts allow" = "0.0.0.0/0";
          "guest account" = "nobody";
          "map to guest" = "bad user";
        };
        # "public" = {
        #   "path" = "/mnt/Shares/Public";
        #   "browseable" = "yes";
        #   "read only" = "no";
        #   "guest ok" = "yes";
        #   "create mask" = "0644";
        #   "directory mask" = "0755";
        #   "force user" = "username";
        #   "force group" = "groupname";
        # };
        "private" = {
          "path" = "/Velaris/Storage/Shares";
          "browseable" = "yes";
          "read only" = "no";
          "guest ok" = "no";
          "create mask" = "0644";
          "directory mask" = "0755";
          "force user" = "polycule";
          "force group" = "polycule";
        };
      };
    };
    nfs.server = {
      enable = true;
      createMountPoints = true;
      lockdPort = 4001;
      mountdPort = 4002;
      statdPort = 4000;
      exports = ''
        /export 10.5.0.0/24(rw,fsid=0,no_subtree_check,no_root_squash)
        /export/containers 10.5.0.0/24(rw,nohide,insecure,no_subtree_check,no_root_squash)
      '';
    };
    target = {
      enable = true;
      config = {
        storage_objects = map (t: {
          dev = "/dev/zvol/${t.zvol}";
          name = t.name;
          plugin = "block";
          wwn = "${nasBase}.${t.name}";        
        }) targets;

        targets = map (t: {
          fabric = "iscsi";
          wwn = "${nasBase}.${t.name}";
          tpgs = [{
            enable = true;
            attributes = {
              authentication = 0;
              generate_node_acls = 0;
            };
            portals = [
              {
                ip_address = "0.0.0.0";
                port = 3260;
              }
            ];
            luns = [
              {
                index = t.lun;
                storage_object = "/backstores/block/${t.name}";
              }
            ];
            node_acls = initiators;
          }];
        }) targets;
      };
    };
  };
  environment.systemPackages = with pkgs; [
    (writeShellScriptBin "zvolcreate" ''
      SIZE=$1
      ZVOL=$2

      if [[ $EUID -eq 0 ]]; then

        echo "Creating $SIZE Zvol $ZVOL"

        zfs create -s -V $SIZE Velaris/Containers/$ZVOL
        sleep 1
        mkfs.xfs -b size=16384 -s size=4096 /dev/zvol/Velaris/Containers/$ZVOL
      else
        echo "This script needs to be run as root"
        exit 1
      fi
    '')
  ];
}