{ config, lib, pkgs, inputs, ... }: {

    options.sysconfig.opts.virtualization.pihole.enable = lib.options.mkOption {
        type = lib.types.bool;
        default = false;
    };

    imports = let
        pkgs-us = import inputs.nixpkgs-us { system = "x86_64-linux"; };
    in [
        (import "${inputs.nixpkgs-us}/nixos/modules/virtualisation/nixos-containers.nix" { inherit config lib; pkgs = pkgs-us;})
    ];

    disabledModules = [
        "virtualisation/nixos-containers.nix"
    ];

    config = lib.mkIf config.sysconfig.opts.virtualization.pihole.enable {
/*        sops.secrets."pihole/pass" = {};

        sops.templates."pihole.env" = {
            content = ''
                WEBPASSWORD=${config.sops.placeholder."pihole/pass"}
            '';

            path = "/ssd1/Pihole/.env";
        };
*/

        networking = {

            nat.internalInterfaces = [ "ve-pihole" ];
        };

        containers.pihole = {

            autoStart = true;
            privateNetwork = true;
            hostAddress = "192.168.100.10";
            localAddress = "192.168.100.28";

            timeoutStartSec = "infinity";

            config = let
                pkgs-us = import inputs.nixpkgs-us { system = "x86_64-linux"; };
            in {

                imports = [
                    (import "${inputs.nixpkgs-us}/nixos/modules/services/networking/pihole-ftl.nix" { config = config.containers.pihole.config; inherit lib; pkgs = pkgs-us;})
                        (import "${inputs.nixpkgs-us}/nixos/modules/services/web-apps/pihole-web.nix" { config = config.containers.pihole.config; inherit lib; pkgs = pkgs-us;})
                ];

                services = {
                    pihole-web = {
                        enable = true;

                        package = pkgs-us.pihole-web;

#hostName = "192.168.100.28";

                        ports = [ 80 ];
                    };

                    pihole-ftl = {
                        enable = true;

                        package = pkgs-us.pihole-ftl;

                        openFirewallDNS = true;
                        openFirewallWebserver = true;

                        lists = [
                        {
                            url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts";
                        }
                        ];

                        settings = {
                            dns.upstreams = [ "1.1.1.1" "1.0.0.1" ];
                            #files.macvendor = lib.mkForce "/var/lib/pihole/macvendor.db";
                        };
                    };

                    unbound = {
                        enable = false;

                        settings = {
                            server = {
                                interface = [ "127.0.0.1" ];
                                port = 5335;
                            };

                        };
                    };

                };

                users.users."root" = {
                    openssh.authorizedKeys.keys = [
                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICe6Ito5m9c4Tij8zI74L8hnd/QRchEO/cc5CH94mjMC nathan@homebox"
                    ];
                };

                networking.firewall.allowedTCPPorts = [ 22 ];

                services.openssh = {
                    enable = true;
                    settings = {
                        PermitRootLogin = lib.mkForce "yes";
                        PasswordAuthentication = false;
                        KbdInteractiveAuthentication = false;
                    };
                };



                environment.systemPackages = with pkgs; let
                    pypkgs = ps: with ps; [
                    requests
                    ];

                in [
                    (pkgs.python312.withPackages pypkgs)
                ];
                
                system.stateVersion = "25.05";
            };
        };
    };

    
}