{ config, lib, pkgs, factsGenerator, clanLib, ... }:
with lib;
with types;

{
  options.components.nixos.boot = {

    enable = lib.mkOption {
      type = lib.types.bool;
      default = false;
    };

    kernelModules = mkOption {
      type = listOf str;
      default = [ ];
      description =
        "lspci -v will tell you which kernel module is used for the ethernet interface";
    };

    ssh.enable = lib.mkOption {
      type = lib.types.bool;
      default = config.components.nixos.boot.enable;
    };

    tor.enable = lib.mkOption {
      type = lib.types.bool;
      default = config.components.nixos.boot.ssh.enable;
    };
  };

  config = mkMerge [

    # todo : not working at the moment, because onion hostnames are secrets
    (
      let
        onionIds = clanLib.readFactFromAllMachines "tor.initrd.hostname";
        generateOnionUnlockScript = machine: onionId: pkgs.writers.writeDashBin "unlock-boot-${machine}-via-tor" ''
          ${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222
        '';
      in
      {
        # add known hosts
        services.openssh.knownHosts =
          mapAttrs
            (_machine: onionId: {
              hostNames = [ "[${onionId}]:2222" ];
            })
            onionIds;

        # create unlook tor boot script
        environment.systemPackages =
          mapAttrsToList generateOnionUnlockScript onionIds;
      }
    )

    # tor part
    # --------
    (mkIf (config.components.nixos.boot.tor.enable) {

      #services.tor = {
      #  enable = true;
      #  client.enable = true;
      #  relay.onionServices.bootup.map = [{ port = 2222; }];
      #};

      # tor setup
      clanCore.facts.services.initrd_tor = factsGenerator.tor { name = "initrd"; };

      boot.initrd.secrets = {
        "/etc/tor/onion/bootup/tor.priv" = config.clanCore.facts.services.initrd_tor.secret."tor.initrd.priv".path;
        "/etc/tor/onion/bootup/hostname" = config.clanCore.facts.services.initrd_tor.secret."tor.initrd.hostname".path;
      };

      #boot.initrd.extraUtilsCommands = ''
      #  copy_bin_and_libs ${pkgs.tor}/bin/tor
      #'';

      # fixme: this thing is not working for some reason.
      boot.initrd.systemd.packages = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ];
      boot.initrd.systemd.services.tor = {
        path = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ];
        # todo: set wanted by
        script =
          let
            torRc = pkgs.writeText "tor.rc" ''
              DataDirectory /etc/tor
              SOCKSPort 127.0.0.1:9050 IsolateDestAddr
              SOCKSPort 127.0.0.1:9063
              HiddenServiceDir /etc/tor/onion/bootup
              HiddenServicePort 2222 127.0.0.1:2222
            '';
          in
          ''
            echo "tor: preparing onion folder"
            # have to do this otherwise tor does not want to start
            chmod -R 700 /etc/tor

            echo "make sure localhost is up"
            ip a a 127.0.0.1/8 dev lo
            ip link set lo up

            echo "tor: starting tor"
            tor -f ${torRc} --verify-config
            tor -f ${torRc}
          '';
      };
    })


    # ssh part
    # --------
    (mkIf (config.components.nixos.boot.ssh.enable) {

      # boot
      boot.initrd.systemd.enable = true;
      boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";

      # network
      boot.initrd.systemd.network.enable = true;
      boot.initrd.availableKernelModules = config.components.nixos.boot.kernelModules;

      # ssh
      boot.initrd.network.enable = true;
      boot.initrd.network.ssh = {
        enable = true;
        #authorizedKeys =     config.users.users.root.openssh.authorizedKeys.keys ;
        #authorizedKeyFiles = config.users.users.root.openssh.authorizedKeys.keyFiles;
        port = 2222;
        hostKeys = map ({ path, ... }: path) config.services.openssh.hostKeys;
      };


    })

  ];
}