nodes['kunsi-p14s'] = {
    'hostname': 'localhost',
    'bundles': {
        'arch-with-gui',
        'backup-client',
        'lldp',
        'lm-sensors',
        'nfs-client',
        'openvpn-client',
        'systemd-boot',
        'telegraf-battery-usage',
        'vmhost',
        'wireguard',
        'zfs',
    },
    'groups': {
        'arch',
    },
    'metadata': {
        'arch-with-gui': {
            'autologin_as': 'kunsi',
        },
        'backup-client': {
            'exclude_from_monitoring': False,
            # only alert people if we're missing more than a week of backups
            'one_backup_every_hours': 7 * 24,
        },
        'firewall': {
            'port_rules': {
                # obs websocket thingie - just allow all RFC1918 ips here
                #'4444': {
                #    '10.0.0.0/8',
                #    '172.16.0.0/12',
                #    '192.168.0.0/16',
                #},
                # For the occasional file-share using `python -m http.server`
                '8000/tcp': {'*'},
            },
        },
        'interfaces': {
            'br0': {
                'ips': {'10.73.100.103/16'},
                'gateway4': '10.73.0.254',
                'dhcp': True,
            },
            # there is also wlp3s0, but that's managed by netctl
        },
        'nfs-client': {
            'mounts': {
                'nas-scansnap': {
                    'mountpoint': '/mnt/scansnap',
                    'serverpath': '172.19.138.20:/srv/scansnap',
                    'mount_options': {
                        'retry=0',
                        'rw',
                    },
                },
                'nas-storage': {
                    'mountpoint': '/mnt/nas',
                    'serverpath': '172.19.138.20:/storage/nas',
                    'mount_options': {
                        'retry=0',
                        'ro',
                    },
                },
            },
        },
        'nftables': {
            'forward': {
                '50-routing': [
                    'ct state { related, established } accept',
                    'oifname wlan0 accept',
                ],
            },
            'postrouting': {
                '50-routing': [
                    'oifname wlan0 masquerade',
                ],
            },
        },
        'openssh': {
            'restrict-to': {
                'rfc1918',
            },
        },
        'openvpn-client': {
            'configs': {
                'c3voc': {
                    'running': None,
                    'enabled': False,
                },
                'smedia-priv': {
                    'running': None,
                    'enabled': False,
                },
            },
        },
        'pacman': {
            'no_extract': {
                'etc/sudoers.d/ctdb', # samba junk
            },
            'packages': {
                # for hardware support
                'amd-ucode': {},
                'mesa': {},

                # various video drivers
                'libva-mesa-driver': {},
                'mesa-vdpau': {},
                'xf86-video-amdgpu': {},

                # all that other random stuff one needs
                'abcde': {},
                'apachedirectorystudio': {},
                'claws-mail': {},
                'claws-mail-themes': {},
                'ferdi-bin': {},
                'gumbo-parser': {}, # for claws litehtml
                'inkstitch': {}, # for RZL embroidery machine
                'obs-studio': {},
                'perl-musicbrainz-discid': {}, # for abcde
                'perl-webservice-musicbrainz': {}, # for abcde
                'sdl_ttf': {}, # for compiling testcard
                'x32edit': {},
            },
        },
        'systemd-boot': {
            'default': 'arch',
            'entries': {
                'arch': {
                    'title': 'Arch Linux',
                    'linux': '/vmlinuz-linux',
                    'initrd': [
                        '/amd-ucode.img',
                        '/initramfs-linux.img',
                    ],
                    'options': {
                        'net.ifnames=0',
                        'rw',
                        'zfs=zroot/system/root',
                    },
                },
                'arch-fallback': {
                    'title': 'Arch Linux (no ucode, fallback initramfs)',
                    'linux': '/vmlinuz-linux',
                    'initrd': [
                        '/initramfs-linux-fallback.img',
                    ],
                    'options': {
                        'net.ifnames=0',
                        'rw',
                        'zfs=zroot/system/root',
                    },
                },
            },
        },
        'sysctl': {
            'options': {
                'net.ipv4.conf.all.forwarding': '1',
            },
        },
        'systemd-networkd': {
            'bridges': {
                'br0': {
                    'match': {
                        'en*',
                        'eth*',
                    },
                },
            },
        },
        'timezone': 'Europe/Berlin',
        'users': {
            'kunsi': {
                'password': vault.decrypt('encrypt$gAAAAABgLmmuQGRUStrQawoPee-758emIYn2u8-8ebrgzNAFSp7ifeFDdXXvs-zL3QogwNYlCtBHboH2xfy1rSj6OF5bbNO-tg=='),
                'shell': '/usr/bin/fish',
            },
            'sophie': {
                'delete': True,
            },
        },
        'wireguard': {
            'peers': {
                'htz-cloud.wireguard': {
                    'auto_connection': False,
                    'endpoint': 'wireguard.htz-cloud.kunbox.net:1194',
                    'my_ip': '172.19.136.65',
                    'my_port': 51819,
                    'their_ip': '172.19.136.64',
                    'routes': {
                        '172.19.128.0/20',
                    },
                },
            },
        },
        'zfs': {
            'pools': {
                'zroot': {
                    'when_creating': {
                        'config': [{
                            'devices': [
                                '/dev/disk/by-id/nvme-UMIS_RPETJ1T24MGE2QDQ_SS0L25218X3RC1BG1182-part2',
                            ],
                        }],
                        'ashift': 12,
                    },
                },
            },
            'datasets': {
                # this is not a complete list, but we can't create that
                # structure using bundlewrap anyway, so there's no point
                # in adding it here.
                'zroot': {
                    'compression': 'lz4',
                    'relatime': 'on',
                    'xattr': 'sa',
                    'primarycache': 'metadata'
                    # encryption is enabled, too.
                },
                'zroot/movies': {
                    'mountpoint': '/media/movies',
                },
                'zroot/nextcloud': {
                    'mountpoint': '/home/kunsi/nextcloud',
                },
                'zroot/system/journal': {
                    'mountpoint': '/var/log/journal',
                    'acltype': 'posix',
                },
                'zroot/system/libvirt': {
                    'mountpoint': '/var/lib/libvirt',
                    'needed_by': {
                        'bundle:vmhost',
                    },
                },
                'zroot/system/video': {
                    'mountpoint': '/video',
                    'needed_by': {
                        'bundle:voc-tracker-worker',
                    },
                },
                'zroot/system/root': {
                    'canmount': 'noauto',
                    'mountpoint': 'legacy',
                },
                'zroot/user/kunsi': {
                    'mountpoint': '/home/kunsi',
                },
            },
            'snapshots': {
                'retain_per_dataset': {
                    'zroot/user/kunsi': {
                        # juuuuuuuust to be sure
                        'hourly': 100,
                    },
                },
                'snapshot_never': {
                    'zroot/movies',
                    'zroot/nextcloud',
                    'zroot/system/journal',
                    'zroot/system/video',
                },
            },
        },
    },
    'os': 'arch',
}