{ pkgs, ... }:
let
  downloadDir = "/mnt/Downloads/";
in
{
  # Enable automatic login for the user.
  services = {
    # sudo tailscale up --operator=$USER 
    # use https://hs.wetofu.me
    tailscale.enable = true;
    logrotate.checkConfig = false;

    openssh = {
      enable = true;
      banner = ''
        Must back to QingDao! Must back HOME!
      '';

      settings = {
        PermitRootLogin = "no";
        PasswordAuthentication = false;
      };
    };

    ntp = {
      enable = true;
      servers = [
        "ntp.ntsc.ac.cn" # China
      ];
    };

    transmission = {
      enable = true;
      openPeerPorts = true;
      downloadDirPermissions = "777";
      credentialsFile = "/var/secrets/transmission/settings.json";

      settings = {
        download-dir = downloadDir;
        peer-port-random-low = 42333;
        peer-port-random-on-start = true;
        incomplete-dir-enabled = false;
        incomplete-dir = downloadDir ++ ".incomplete";
      };
    };

    resilio = {
      enable = true;
      deviceName = "Gangly4670";
      enableWebUI = true;
      directoryRoot = downloadDir;
    };

    kubo = {
      enable = false;
      dataDir = "/mnt/ipfs";
      enableGC = true;
    };

    nginx = {
      enable = true;
      virtualHosts = {
        default = {
          default = true;
          locations = {
            "/" = {
              root = "/var/lib/nginx/html";
            };

            "/files/" = {
              alias = downloadDir;
              extraConfig = ''
                autoindex on;
                autoindex_exact_size off;
                
                add_before_body /.theme/header.html;
                add_after_body /.theme/footer.html;
              '';
            };

            "/transmission" = {
              proxyPass = "http://localhost:9091";
            };

            # resilio
            "/gui" = {
              proxyPass = "http://localhost:9000";
            };



            # kubo/ipfs
            /*
              "/ipfs" = {
              proxyPass = "http://localhost:8080";
              };

              "/ipns" = {
              proxyPass = "http://localhost:8080";
              };

              "/ipfs-ui" = {
              proxyPass = "http://localhost:5001/webui/";
              };
            */
          };
        };
      };
    };

    samba = {
      enable = true;
      shares = {
        share = {
          path = downloadDir;
          browseable = "yes";
          "read only" = true;
        };
      };
    };
  };

  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
    libraspberrypi
    vim
  ];

  programs = {
    git.enable = true;
  };
}