{ config, pkgs, ... }:

{
  ########################################
  # AdGuardHome (DNS / DNS-Filter)
  ########################################
  services.adguardhome = {
    enable = true;
    host = "127.0.0.1";
    port = 3000;      # Web-UI
  };

  ########################################
  # Caddy (Reverse Proxy)
  ########################################
  services.caddy = {
    enable = true;
    email = "daniel@lindenfelser.de";
    virtualHosts = {
      "files.home.lindenfelser.de" = {
        extraConfig = ''
          reverse_proxy 10.202.82.6:8080
        '';
      };
      "cloud.home.lindenfelser.de" = {
        extraConfig = ''
          reverse_proxy 10.202.82.6:8080
        '';
      };
      "dns.home.lindenfelser.de" = {
        extraConfig = ''
          reverse_proxy 127.0.0.1:3000
        '';
      };
      "smart.home.lindenfelser.de" = {
        extraConfig = ''
          reverse_proxy 10.202.82.30:8123
        '';
      };
      "git.home.lindenfelser.de" = {
        extraConfig = ''
          reverse_proxy 10.202.82.6:3000
        '';
      };
      "konnektor.home.lindenfelser.de" = {
        extraConfig = ''
          reverse_proxy 10.202.82.49:8080
        '';
      };
    };
  };

  ########################################
  # Firewall
  ########################################
  networking.firewall.enable = true;
  
  networking.firewall.allowedTCPPorts = [
    22    # SSH
    80    # HTTP (Caddy)
    443   # HTTPS (Caddy)
    2222  # External SSH to Gitea
  ];

  networking.firewall.allowedUDPPorts = [
    53    # DNS (AdGuardHome)
  ];

  ########################################
  # NAT / Port Forwarding
  ########################################
  networking.nat = {
    enable = true;
    externalInterface = "ens18";
    # Hairpin NAT for LAN clients hitting gateway:2222 so replies go back via gateway
    extraCommands = ''
      iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.6 --dport 2222 -j MASQUERADE
    '';
    forwardPorts = [
      {
        proto = "tcp";
        sourcePort = 2222;
        destination = "10.202.82.6:2222";
      }
    ];
  };
}