{ config, pkgs, ... }:
let
  nixos-version = "22.05";
  additional_ip_ranges = [
    "77.191.63.30/32"
  ];
in
{
  # prices : https://aws.amazon.com/ec2/pricing/on-demand/
  provider.aws.region = "us-west-2"; # gpu is cheaper here

  provider.aws.default_tags.tags = {
    terranix = true;
    project = "stable-diffusion";
  };

  variable.MY_IP = {
    type = "string";
    default = "0.0.0.0/32";
    description = "ip address to be whitelisted";
  };

  data.aws_ami.gpu-monster = {
    owners = [ "self" ];
    most_recent = true;
    filter = [{
      name = "name";
      values = [ "automatic1111-stable-diffusion-*" ];
    }];
  };

  resource = {

    aws_instance.gpu-monster = {
      instance_type = "g5.xlarge"; # Moar GPU is better (24GB)
      ami = "\${data.aws_ami.gpu-monster.image_id}";
      key_name = "palo";
      vpc_security_group_ids = [ "\${aws_security_group.gpu-monster.id}" ];
      tags.Name = "Stable Diffusion";
      tags.cost = "gpu";
      root_block_device = {
        encrypted = true;
        volume_size = 30;
        tags.Name = "Stable Diffusion Root";
        tags.cost = "volume";
      };
      iam_instance_profile = "\${aws_iam_instance_profile.instance_profile.id}";
    };
    aws_iam_role.instance_role = {
      name = "gpu-monster_role";
      assume_role_policy = toString (builtins.toJSON
        {
          Version = "2012-10-17";
          Statement = [
            {
              Action = "sts:AssumeRole";
              Principal.Service = "ec2.amazonaws.com";
              Effect = "Allow";
            }
          ];
        });
    };
    aws_iam_instance_profile.instance_profile = {
      name = "gpu-monster_profile";
      role = config.resource.aws_iam_role.instance_role.name;
    };
    aws_security_group.gpu-monster = {
      name = "gpu-monster-sg";
    };
    aws_security_group_rule = {
      http = {
        type = "ingress";
        description = "http access";
        from_port = 80;
        to_port = 80;
        protocol = "tcp";
        cidr_blocks = [ "\${var.MY_IP}" ] ++ additional_ip_ranges;
        security_group_id = "\${aws_security_group.gpu-monster.id}";
      };
      all-for-admin = {
        type = "ingress";
        description = "admin access";
        from_port = 0;
        to_port = 0;
        protocol = "-1";
        cidr_blocks = [ "\${var.MY_IP}" ];
        security_group_id = "\${aws_security_group.gpu-monster.id}";
      };
      out = {
        type = "egress";
        from_port = 0;
        to_port = 0;
        protocol = "-1";
        cidr_blocks = [ "0.0.0.0/0" ];
        security_group_id = "\${aws_security_group.gpu-monster.id}";
      };
    };

    local_file.colmena-configuration = {
      filename = "./configuration-target.nix";
      content = ''
        # generated by terranix to be imported by colmena
        {
          deployment = {
            buildOnTarget = true;
            targetUser = "root";
            targetHost = "''${aws_instance.gpu-monster.public_ip}";
          };
        }
      '';
    };
  };

  output.ipaddress.value = "\${aws_instance.gpu-monster.public_dns}";

}
