{ options, config, pkgs, lib, ... }:

with lib;

let
  cfg            = config.services.travelynx2fedi;
  settingsFormat = pkgs.formats.ini {};
  configFile     = settingsFormat.generate "config.ini" cfg.config;

in {

  options = {
    services.travelynx2fedi = with lib; {
      enable = mkEnableOption "travelynx2fedi - post travelynx checkins to the fediverse";

      nginx = {
        enable     = mkEnableOption "";
        enableACME = mkEnableOption "";

        domain = mkOption {
          type = types.str;
        };

        path = mkOption {
          type    = types.str;
          default = "= /travelynx2fedi";
        };
      };

      package = mkOption {
        type    = types.package;
        default = pkgs.travelynx2fedi;
      };

      port = mkOption {
        type     = types.int;
        default  = 8321;
      };

      config = mkOption {
        type    = settingsFormat.type;
        default = {};
        example = {};
      };

      environmentFiles = mkOption {
        type = types.listOf types.path;
        default = [];
        example = [ "/run/keys/travelynx2fedi.env" ];
        description = lib.mdDoc ''
          File to load as environment file. Environment variables from this file
          will be interpolated into the config file using envsubst.
          This is useful to avoid putting secrets into the nix store.
        '';
      };

    };
  };


  config = lib.mkIf cfg.enable {

    services.nginx = lib.mkIf cfg.nginx.enable {
      virtualHosts."${cfg.nginx.domain}" = {
        enableACME = lib.mkIf cfg.nginx.enableACME true;
        forceSSL   = lib.mkIf cfg.nginx.enableACME true;
        locations."${cfg.nginx.path}".proxyPass = "http://[::1]:${builtins.toString cfg.port}";
      };
    };

    systemd.services.travelynx2fedi = {
      after           = [ "network-online.target" ];
      wantedBy        = [ "multi-user.target" ];

      environment = {
        TRAVELYNX2FEDI_PORT         = builtins.toString cfg.port;
        TRAVELYNX2FEDI_CONFIG_PATH  = (
          if cfg.environmentFiles == []
          then configFile
          else "/var/run/travelynx2fedi/config.ini"
        );
      };

      serviceConfig = {
        DynamicUser = true;

        Type = "exec";

        RuntimeDirectory   = "travelynx2fedi";
        StateDirectory     = "travelynx2fedi";
        StateDirectoryMode = "750";

        EnvironmentFile = cfg.environmentFiles;

        
        Restart    = "always";
        RestartSec = 3;

        ExecStartPre = lib.optional (cfg.environmentFiles != []) (pkgs.writeShellScript "travelynx2fedi-preStart" ''
          umask 077
          ${pkgs.envsubst}/bin/envsubst -i "${configFile}" > /var/run/travelynx2fedi/config.ini
        '');

        ExecStart = "${cfg.package}/bin/travelynx2fedi";

        NoNewPrivileges = true;
        PrivateTmp      = true;
        PrivateDevices  = false;

        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
        RestrictNamespaces      = true;
        RestrictRealtime        = true;
      
        ProtectSystem         = "full";
        ProtectControlGroups  = true;
        ProtectKernelModules  = true;
        ProtectKernelTunables = true;

        DevicePolicy     = "closed";
        LockPersonality  = true;
      };
    };

  };

}