{
  inputs,
  pkgs,
  config,
  ...
}:
let
  sitename = "poyerp.newedge.house";
in
{
  clan.core.settings.machine.description = "VM machine that host ERPNext for poysound";
  imports = [
    inputs.frappix.nixosModules.x86_64-linux.frappix

    (import ../../lib/auto-accept-zerotier-members.nix {
      memberIds = [
        # Alex Caddy gateway
        "dbe44c0287"
        "e3d6559697"
      ];
    })
  ];
  nixpkgs.overlays = [
    inputs.self.overlays.frappixFrappeOverlay
    inputs.self.overlays.frappixLibsOverlay
    inputs.self.overlays.frappixPythonOverlay
    inputs.self.overlays.frappixToolsOverlay
  ];

  clan.core.vars.generators.frappix = {
    files = {
      sslCertificate.secret = false;
      sslCertificateKey = {
        owner = "nginx";
        group = "nginx";
        secret = true;
      };
      adminPassword.secret = true;
    };
    runtimeInputs = with pkgs; [
      openssl
      xkcdpass
    ];
    script = ''
      openssl req -x509 -newkey rsa:4096 -keyout $out/sslCertificateKey -out $out/sslCertificate -sha256 -days 3650 -nodes -subj "/C=TH/ST=ChiangMai/L=ChiangMai/O=kurogeek/CN=kurogeek.home" 
      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminPassword
    '';
  };

  services.frappe = {
    enable = true;
    project = "poyerp";
    gunicorn_workers = 2;
    adminPassword = config.clan.core.vars.generators.frappix.files.adminPassword.path;
    apps = [
      pkgs.frappix.erpnext
      pkgs.frappix.hrms
    ];
    sites = {
      "${sitename}" = {
        domains = [ sitename ];
        apps = [
          "frappe"
          "erpnext"
          "hrms"
        ];
      };
    };
  };
  services.nginx.virtualHosts."${sitename}" = {
    sslCertificate = config.clan.core.vars.generators.frappix.files.sslCertificate.path;
    sslCertificateKey = config.clan.core.vars.generators.frappix.files.sslCertificateKey.path;
  };

  nixpkgs.hostPlatform = {
    system = "x86_64-linux";
  };

  clan.core.vars.generators.nginx = {
    files = {
      sslCert = {
        owner = "nginx";
        group = "nginx";
        secret = true;
      };
      sslKey = {
        owner = "nginx";
        group = "nginx";
        secret = true;
      };
    };

    runtimeInputs = [
      pkgs.openssl
    ];
    script = ''
      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
        -keyout $out/sslKey \
        -out $out/sslCert \
        -subj "/CN=localhost"
    '';
  };

  networking.firewall.allowedTCPPorts = [
    80
    443
  ];

  # services.nginx.virtualHosts."${domain}" = {
  #   forceSSL = true;
  #   sslCertificate = config.clan.core.vars.generators.nginx.files.sslCert.path;
  #   sslCertificateKey = config.clan.core.vars.generators.nginx.files.sslKey.path;
  # };

  system.stateVersion = "25.11";
  clan.core.sops.defaultGroups = [ "admins" ];
}
