{ config, ... }:
let
  # Public DNS avoids depending on an unspecified home router/resolver.
  dnsResolvers = [ "1.1.1.1" "9.9.9.9" ];
  lanIPv4 = "10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16";
in
{
  networking.hostName = "spindle-exec-1";
  networking.nameservers = dnsResolvers;
  networking.dhcpcd.extraConfig = "nohook resolv.conf";

  services.tangled.spindle = {
    enable = true;
    role = "executor";
    executor = {
      name = config.networking.hostName;
      millUrl = "wss://spindle.demi.dev/mill";
      tokenFile = "/var/lib/secrets/spindle-executor.token";
      seats = 4;
      labels = [ "linux" "x86_64" ];
    };
    environmentFile = "/var/lib/secrets/spindle-executor.env";
    mill.artifactStore = "s3";
    artifactStores.s3 = {
      # SPINDLE_ARTIFACT_STORES_S3_BUCKET in the environment file overrides this.
      bucket = "";
      # Let the AWS SDK read AWS_REGION from the runtime environment file.
      region = "";
    };
    pipelines = {
      workflowTimeout = "15m";
      nixery = {
        maxConcurrentWorkflows = 4;
        maxJobMemoryMb = 6144;
      };
    };
  };

  virtualisation.docker = {
    enable = true;
    daemon.settings = {
      dns = dnsResolvers;
      log-driver = "json-file";
      log-opts = {
        max-size = "10m";
        max-file = "3";
      };
    };
    autoPrune = {
      enable = true;
      dates = "weekly";
      flags = [ "--all" "--filter" "until=168h" ];
    };
  };
  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 14d";
  };

  networking.nftables = {
    enable = true;
    tables.spindle-isolation = {
      family = "inet";
      content = ''
        chain docker-egress {
          ip daddr { ${builtins.concatStringsSep ", " dnsResolvers} } meta l4proto { tcp, udp } th dport 53 accept
          ip daddr { ${lanIPv4}, 169.254.0.0/16 } drop
          ip6 daddr { fc00::/7, fe80::/10 } drop
        }

        # Run before Docker's accept rules, including for established connections.
        chain forward {
          type filter hook forward priority -10; policy accept;
          iifname { "docker0", "br-*" } jump docker-egress
        }

        # Also block jobs from reaching the VM's own LAN/bridge addresses.
        chain input {
          type filter hook input priority -10; policy accept;
          # Neighbor discovery is required to keep IPv6 public egress working.
          iifname { "docker0", "br-*" } ip6 hoplimit 255 icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept
          iifname { "docker0", "br-*" } jump docker-egress
        }
      '';
    };
  };
  networking.firewall = {
    enable = true;
    extraInputRules = ''
      ip saddr { ${lanIPv4} } tcp dport 22 accept
    '';
  };

  services.openssh = {
    enable = true;
    openFirewall = false;
    settings = {
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;
      PermitRootLogin = "prohibit-password";
    };
  };
  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPWqQVrFLbK57rpD5uUXDPxhLVejDoOqTX+4XMeH+px pneumo-lead@spindle-exec-1"
  ];

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  time.timeZone = "UTC";
  system.stateVersion = "26.05";
}