{ config, pkgs, ... }:

let
  envsubstConfiguration = {
    TLD = "$TLD";
    nextcloudTLD = "$NEXTCLOUD_TLD";
    gitTLD = "$GIT_TLD";
    prosodyTLD = "$PROSODY_TLD";
    bonecoTLD = "$BONECO_TLD";
    letsencryptEmail = "$LETSENCRYPT_EMAIL";
    authorizedKey = "$AUTHORIZED_KEY";
    userPassword = "$USER_PASSWORD";
    userName = "$USER_NAME";
    nextcloudDatabaseUser = "$NEXTCLOUD_DATABASE_USER";
    nextcloudDatabasePassword = "$NEXTCLOUD_DATABASE_PASSWORD";
    nextcloudAdminUser = "$NEXTCLOUD_ADMIN_USER";
    nextcloudAdminPassword = "$NEXTCLOUD_ADMIN_PASSWORD";
    nextcloudTablePrefix = "$NEXTCLOUD_TABLE_PREFIX";
    gitRoot = "$GIT_ROOT";
    gitPort = "$GIT_PORT";
    systemStateVersion = "$SYSTEM_STATE_VERSION";
    prosodyAdminUser = "$PROSODY_ADMIN_USER";
    prosodyMUCTLD = "$PROSODY_MUC_TLD";
    prosodyPort = "$PROSODY_PORT";
    prosodyHTTPPort = "$PROSODY_HTTP_PORT";
    matterbridgeTelegramToken = "$MATTERBRIDGE_TELEGRAM_TOKEN";
    matterbridgeTelegramChannel = "$MATTERBRIDGE_TELEGRAM_CHANNEL";
    matterbridgeBotJID = "$MATTERBRIDGE_BOT_JID";
    matterbridgeBotPassword = "$MATTERBRIDGE_BOT_PASSWORD";
    matterbridgeBotNick = "$MATTERBRIDGE_BOT_NICK";
    matterbridgeMUCServer = "$MATTERBRIDGE_MUC_SERVER";
    matterbridgeXMPPServer = "$MATTERBRIDGE_XMPP_SERVER";
    matterbridgeXMPPChannel = "$MATTERBRIDGE_XMPP_CHANNEL";
  };
  boneco = pkgs.stdenv.mkDerivation {
    name = "boneco";
    src =
      fetchTarball "https://git.sr.ht/~euandreh/boneco/archive/master.tar.gz";
    phases = "unpackPhase buildPhase";
    buildPhase = ''
      mkdir ${DOLLAR}out
      cp index.html ${DOLLAR}out
      cp favicon.ico ${DOLLAR}out
    '';
  };
in {
  imports = [ ./hardware-configuration.nix ];

  boot.loader.grub = {
    enable = true;
    version = 2;
    device = "/dev/vda";
  };

  networking = {
    useDHCP = false;
    interfaces.ens3.useDHCP = true;
  };

  environment.systemPackages = with pkgs; [ vim git ];

  networking.firewall.allowedTCPPorts = [
    # SSH: OpenSSH
    22

    # HTTP and HTPPS: NGINX
    80
    443

    # XMPP: Prosody
    # https://prosody.im/doc/ports
    5000
    5222
    5269
    5280
    5281
    5347
    5582
  ];

  security.acme = {
    acceptTerms = true;
    email = envsubstConfiguration.letsencryptEmail;
  };

  services = {
    openssh = {
      enable = true;
      permitRootLogin = "no";
      passwordAuthentication = false;
    };

    nginx = {
      enable = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
      virtualHosts = {
        "${envsubstConfiguration.nextcloudTLD}" = {
          forceSSL = true;
          enableACME = true;
        };
        "${envsubstConfiguration.gitTLD}" = {
          forceSSL = true;
          enableACME = true;
          locations."/" = {
            proxyPass = "http://localhost:${envsubstConfiguration.gitPort}";
          };
        };
        "${envsubstConfiguration.bonecoTLD}" = {
          forceSSL = true;
          enableACME = true;
          root = boneco;
        };
        "${envsubstConfiguration.prosodyTLD}" = {
          forceSSL = true;
          enableACME = true;
          serverAliases = [ envsubstConfiguration.prosodyMUCTLD ];
          locations = {
            "/" = {
              proxyPass =
                "http://localhost:${envsubstConfiguration.prosodyHTTPPort}/";
            };
          };
        };
      };
    };

    postgresql = {
      enable = true;
      ensureDatabases = [ "nextcloud" ];
      package = pkgs.postgresql_11;
      ensureUsers = [{
        name = "nextcloud";
        ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
      }];
    };

    nextcloud = {
      enable = true;
      package = pkgs.nextcloud19;
      nginx.enable = true;
      hostName = envsubstConfiguration.nextcloudTLD;
      https = true;
      maxUploadSize = "4G";
      autoUpdateApps.enable = true;
      config = {
        overwriteProtocol = "https";
        dbtype = "pgsql";
        dbhost = "/run/postgresql";
        dbuser = envsubstConfiguration.nextcloudDatabaseUser;
        dbpass = envsubstConfiguration.nextcloudDatabasePassword;
        dbtableprefix = envsubstConfiguration.nextcloudTablePrefix;
        adminuser = envsubstConfiguration.nextcloudAdminUser;
        adminpass = envsubstConfiguration.nextcloudAdminPassword;
      };
    };

    prosody = let
      fullchainPEM =
        "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/fullchain.pem";
      keyPEM = "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/key.pem";
    in {
      enable = true;
      admins = [ envsubstConfiguration.prosodyAdminUser ];
      allowRegistration = false;
      modules = { websocket = true; };
      package = pkgs.prosody.override {
        withCommunityModules = [ "http_upload" "conversejs" "bookmarks" ];
      };
      extraModules = [ "http_upload" "conversejs" "bookmarks" ];
      ssl = {
        cert = fullchainPEM;
        key = keyPEM;
      };
      virtualHosts = {
        "${envsubstConfiguration.prosodyTLD}" = {
          enabled = true;
          domain = "${envsubstConfiguration.prosodyTLD}";
          ssl = {
            cert = fullchainPEM;
            key = keyPEM;
          };
        };
      };
      # muc = [{
      #   domain = envsubstConfiguration.prosodyMUCTLD;
      # }];
    };

    matterbridge = {
      enable = true;
      configFile = ''
        [telegram.mytelegram]
        Token="${envsubstConfiguration.matterbridgeTelegramToken}"
        RemoteNickFormat="[{PROTOCOL}] <{NICK}>"

        [xmpp.myxmpp]
        Server="${envsubstConfiguration.matterbridgeXMPPServer}"
        Jid="${envsubstConfiguration.matterbridgeBotJID}"
        Password="${envsubstConfiguration.matterbridgeBotPassword}"
        Muc="${envsubstConfiguration.matterbridgeMUCServer}"
        Nick="${envsubstConfiguration.matterbridgeBotNick}"
        RemoteNickFormat="[{PROTOCOL}] <{NICK}>"

        [[gateway]]
        name="gateway1"
        enable=true

        [[gateway.inout]]
        account="telegram.mytelegram"
        channel="${envsubstConfiguration.matterbridgeTelegramChannel}"

        [[gateway.inout]]
        account="xmpp.myxmpp"
        channel="${envsubstConfiguration.matterbridgeXMPPChannel}"
      '';
    };

    lighttpd = {
      enable = true;
      port = pkgs.lib.toInt envsubstConfiguration.gitPort;
      cgit = {
        enable = true;
        subdir = "";
        configText = ''
          source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
          about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh
          scan-path=${envsubstConfiguration.gitRoot}
        '';
      };
    };
  };

  systemd.services = {
    "nextcloud-setup" = {
      requires = [ "postgresql.service" ];
      after = [ "postgresql.service" ];
    };
    "lighttpd-cgit-install" = {
      enable = true;
      description = "Setup folders and permissions for lighttpd and cgit";
      wantedBy = [ "multi-user.target" ];
      script = ''
        mkdir -p ${envsubstConfiguration.gitRoot}
        chown -R ${envsubstConfiguration.userName}:lighttpd ${envsubstConfiguration.gitRoot}
        chmod -R 770 ${envsubstConfiguration.gitRoot}
      '';
      serviceConfig = { Type = "oneshot"; };
    };
  };

  users.extraUsers."${envsubstConfiguration.userName}" = {
    uid = 1000;
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    password = envsubstConfiguration.userPassword;
    openssh.authorizedKeys.keys = [ envsubstConfiguration.authorizedKey ];
  };

  system.stateVersion = envsubstConfiguration.systemStateVersion;
}