{ config, depot, lib, ... }:

let
  inherit (depot.ops) secrets;
  pkg = depot.web.quotes;

  sock = "/run/quotesdb/gunicorn.sock";
in
{
  config = {
    security.acme = {
      acceptTerms = true;
      email = lib.mkDefault "letsencrypt@lukegb.com";
      certs."bfob.gg" = {
        group = config.services.nginx.group;
        dnsProvider = "cloudflare";
        credentialsFile = secrets.cloudflareCredentials;
        extraDomainNames = ["*.bfob.gg"];
      };
    };
    services.nginx = {
      enable = lib.mkDefault true;
      virtualHosts."qdb.bfob.gg" = {
        useACMEHost = "bfob.gg";
        globalRedirect = "quotes.bfob.gg";
        forceSSL = true;
      };
      virtualHosts."quotes.bfob.gg" = {
        useACMEHost = "bfob.gg";
        forceSSL = true;
        locations."/static" = {
          root = "${pkg}/share";
        };
        locations."/" = {
          proxyPass = "http://unix:${sock}";
        };
      };
    };

    services.postgresql = {
      enable = lib.mkDefault true;
      ensureDatabases = lib.mkAfter [ "quotesdb" ];
      ensureUsers = lib.mkAfter [{
        name = "quotesdb";
        ensurePermissions = {
          "DATABASE quotesdb" = "ALL PRIVILEGES";
        };
      }];
    };

    systemd.services.quotesdb = {
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      serviceConfig = {
        EnvironmentFile = secrets.quotesdb.environment;
        RuntimeDirectory = "quotesdb";
        ExecStart = "${pkg}/bin/quotes --workers 3 --bind unix:${sock}";
        DynamicUser = true;
        Group = "nginx";
        UMask = "0007";
      };
    };
  };
}