{ config, lib, ... }:
let
  cfg = import ./vars.nix;
  port = cfg.ihatemoney.port;
  db = cfg.ihatemoney.db;
  dbport = cfg.ihatemoney.dbport;
  domain = cfg.ihatemoney.domain;
in
{

  imports = [
    #./podman.nix
    ./podman-postgresql.nix # for the database
    ./nginx.nix             # for the webserver
  ];

  sops.secrets."${db}/db" = {};
  sops.secrets."${db}/env" = {};

  services.podman-postgresql."${db}" = {
    enable = true;
    image = "docker.io/library/postgres:16-alpine";
    port = (lib.strings.toInt dbport);
    passwordFile = config.sops.secrets."${db}/db".path;
  };

  services.nginx.virtualHosts."${domain}" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://localhost:${port}";
      extraConfig = ''
      '';
    };
    extraConfig = ''
      access_log  /var/log/nginx/${domain}_access.log;
      error_log   /var/log/nginx/${domain}_error.log;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-Protocol $scheme;
      proxy_redirect off;
      proxy_connect_timeout 90;
      proxy_send_timeout 180;
      proxy_read_timeout 180;
      proxy_buffer_size 16k;
      proxy_buffers 8 16k;
      proxy_busy_buffers_size 32k;
      proxy_intercept_errors on;
    '';
  };

  virtualisation.oci-containers.containers.ihatemoney = {
    image = "docker.io/ihatemoney/ihatemoney";
    environment = {
      ACTIVATE_ADMIN_DASHBOARD = "True";
      ACTIVATE_DEMO_PROJECT = "False";
      ALLOW_PUBLIC_PROJECT_CREATION = "False";
      MAIL_DEFAULT_SENDER = "Budget manager <ihatemoney@mc-fucker.cool>";
      MAIL_SERVER = "mc1.mc-fucker.vpn.mc-fucker.cool";
      MAIL_USE_TLS = "True";
      DEBUG = "False";
    };
    ports = [ "${port}:${port}" ];
    #environmentFiles = [ /etc/nixos/keys/ihatemoney-env ];
    environmentFiles = [ /run/secrets/ihatemoney/env ];
    extraOptions = cfg.podman.extraOptions;
  };

  #services.postgresql = {
  #  ensureDatabases = [ db ];
  #  #ensureUsers = [
  #  #  {
  #  #    name = db;
  #  #    ensurePermissions = {
  #  #      "DATABASE ${db}" = "ALL PRIVILEGES";
  #  #    };
  #  #  }
  #  #];
  #  authentication = "host ${db} ${db} 10.88.0.0/16 md5";
  #};

  #services.postgresqlBackup.databases = [ "ihatemoney" ];

}

# vim: set et ts=2 sw=2 ai: