{config, lib,...}:
let
cfg = config.addons.remote_builder; 
in 
{
  options.addons.remote_builder = {
    enable = lib.mkEnableOption "Enable remote builder support"; 
    allowedKeyFiles = lib.mkOption {
      default = []; 
      example = [../secrets/example.pub];  
      description = "Public key files that are allowed on the remote builder"; 
    };
    allowedKeys = lib.mkOption {
      default = []; 
      example = ["ssh-ed25519 ... user@example.com"];  
      description = "Public keys that are allowed on the remote builder"; 
    };
    emulatedSystems = lib.mkOption {
      default = []; 
      example = ["aarch64-linux"];  # TODO: This probably has a nice type that could be used
      description = "Allow the remote builder to emultate builds for certain architectures";  
    }; 
    openFirewall = lib.mkEnableOption "Forces the ssh port open for the remote builder"; 
  };

  config = lib.mkIf cfg.enable (lib.mkMerge [
    {
      users.users.remotebuild = {
        isSystemUser = true; 
        group = "remotebuild";
        useDefaultShell = true; 
        # Add keys to remotebuild user.
        openssh.authorizedKeys = { 
          keyFiles = cfg.allowedKeyFiles; 
          keys = cfg.allowedKeys; 
        };
      };

      users.groups.remotebuild = {}; 
      nix = {
        nrBuildUsers = 64;
        settings = {
          trusted-users = [ "remotebuild" ];

          min-free = 10 * 1024 * 1024;
          max-free = 200 * 1024 * 1024;

          max-jobs = "auto";
          cores = 8;
        };
      };

      boot.binfmt.emulatedSystems = cfg.emulatedSystems;  


      # TODO: Make a good default module for ssh. 
      services.openssh = {
        enable = true; 
        settings.AllowUsers = ["remotebuild"];
      };
    }  

    # Open firewall for ssh if not open already, not really recommended unless the server is meant to be public. 
    (lib.mkIf cfg.openFirewall {
      services.openssh.openFirewall = lib.mkForce true; 
    }) 
  ]);


}