{ self, profiles, suites, pkgs, ... }:
{
  imports = [
    ./configuration.nix
    ../profiles/core
    ../profiles/server
    # ../profiles/metrics
    ../profiles/gitea
    # ../profiles/woodpecker-server
    ../profiles/rss-bridge
    # ../profiles/mount-mossnet
    ../profiles/freshrss
    ../profiles/microbin
    ../profiles/site
    
    # ../profiles/postgres_upgrade_script
  ];

  # Capsul specific
  users.users.cyberian = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
  };

  age.secrets.helix-wg.file = "${self}/secrets/helix-wg.age";
  age.secrets.helix-wg.owner = "anish";
  mossnet.wg = {
    enable = true;
    ips = [ "10.0.69.5/24" ];
    privateKeyFile = "/run/agenix/helix-wg";
  };

  # Reverse proxy for immich
  # services.nginx.virtualHosts."photos.sealight.xyz" = {
  #   enableACME = true;
  #   forceSSL = true;

  #   locations."/" = {
  #     extraConfig = ''
  #       proxy_pass http://10.0.69.4:8567;
  #       proxy_set_header Host $host;
  #       proxy_set_header X-Real-IP $remote_addr;
  #       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  #       proxy_set_header X-Forwarded-Proto $scheme;
  #     '';
  #   };
  # };

  services.postgresql.package = pkgs.postgresql_15;
  services.postgresqlBackup = {
    # TODO needs working wireguard to box
    enable = false;
    databases = [ "gitea" "freshrss"  ]; # "woodpecker"
    location = "/mnt/two/postgres";
  };

  mossnet.backup = {
    enable = true;
    name = "helix";
    paths = [
      "/var/lib/gitea"
      "/var/lib/freshrss"
      # "/var/lib/woodpecker"
      "/var/lib/microbin"
    ];

  };
}
