{ config, options, depot, lib, ... }:

let
  inherit (depot.ops) secrets;
  pkg = depot.web.quotes;

  sock = "/run/quotesdb/gunicorn.sock";
in
{
  options = with lib; {
    my.quotesdb.listen = lib.mkOption {
      type = with types; listOf str;
      default = [ "127.0.0.1" "[::1]" ];
    };
  };

  config = let
    nginxListen = (map (addr: {
      inherit addr;
      port = 80;
      ssl = false;
    }) config.my.quotesdb.listen) ++ (map (addr: {
      inherit addr;
      port = 443;
      ssl = true;
    }) config.my.quotesdb.listen);
  in {
    security.acme = {
      acceptTerms = true;
      email = lib.mkDefault "letsencrypt@lukegb.com";
      certs."bfob.gg" = {
        group = config.services.nginx.group;
        dnsProvider = "cloudflare";
        credentialsFile = secrets.cloudflareCredentials;
        extraDomainNames = ["*.bfob.gg"];
      };
    };
    services.nginx = {
      enable = lib.mkDefault true;
      virtualHosts."qdb.bfob.gg" = {
        listen = nginxListen;
        useACMEHost = "bfob.gg";
        globalRedirect = "quotes.bfob.gg";
        forceSSL = true;
      };
      virtualHosts."quotes.bfob.gg" = {
        listen = nginxListen;
        useACMEHost = "bfob.gg";
        forceSSL = true;
        locations."/static" = {
          root = "${pkg}/share";
        };
        locations."/" = {
          proxyPass = "http://unix:${sock}";
        };
      };
      virtualHosts."dev-quotes.bfob.gg" = {
        listen = nginxListen;
        useACMEHost = "bfob.gg";
        forceSSL = true;
        locations."/" = {
          proxyPass = "http://127.0.0.1:8000";
        };
      };
    };

    services.postgresql = {
      enable = lib.mkDefault true;
      ensureDatabases = lib.mkAfter [ "quotesdb" ];
      ensureUsers = lib.mkAfter [{
        name = "quotesdb";
        ensurePermissions = {
          "DATABASE quotesdb" = "ALL PRIVILEGES";
        };
      }];
    };

    systemd.services.quotesdb = {
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      environment.DJANGO_SETTINGS_MODULE = "quotes.quotesapp.prod_settings";
      preStart = ''
        ${pkg}/bin/quotes-manage migrate --no-input
      '';
      serviceConfig = {
        EnvironmentFile = secrets.quotesdb.environment;
        RuntimeDirectory = "quotesdb";
        ExecStart = "${pkg}/bin/quotes --workers 3 --bind unix:${sock}";
        DynamicUser = true;
        Group = "nginx";
        UMask = "0007";
      };
    };
  };
}