{ pkgs, lib, ... }:

{
  imports = [
    ../../modules/common.nix

    ./hardware.nix
    ./devices.nix

    ../../modules/www.nix
    ../../modules/git.nix
  
    ../../services/cgit.nix
    ../../services/soju.nix
    ../../services/gamja.nix
  ];

  systemd.services."acme-renard.serval-moth.ts.net" =
  let
    oneWeekInSeconds = 7 * 24 * 60 * 60;

    tailscaleRenewScript = pkgs.writeShellScript "tailscale-cert-renew" ''
      set -euxo pipefail

      check_validity() {
        pem=$1
        ${pkgs.openssl}/bin/openssl x509 \
          -checkend ${toString oneWeekInSeconds} \
          -noout <$pem
      }

      try_renew() {
        ${pkgs.tailscale}/bin/tailscale cert \
          --cert-file certificates/fullchain.pem \
          --key-file certificates/key.pem \
          renard.serval-moth.ts.net
      }

      cut_out_certificate_authority() {
        fullchain=$1
        buf=""
        while read LINE; do
          if [[ $LINE == *"BEGIN CERTIFICATE"* ]]; then
            buf=""
          fi
          buf="$buf$LINE"$'\n'
        done < $fullchain
        echo "$buf"
      }

      install_certificates() {
        touch out/renewed
        cp -vp 'certificates/fullchain.pem' out/fullchain.pem
        cp -vp 'certificates/key.pem' out/key.pem
        ln -sf fullchain.pem out/cert.pem
        cat out/key.pem out/fullchain.pem > out/full.pem
        cut_out_certificate_authority out/fullchain.pem > out/chain.pem
        chown 'acme:nginx' out/*
        chmod 640 out/*
      }

      if [[ ! -e 'out/fullchain.pem' ]] || ! check_validity out/fullchain.pem; then
        echo 1>&2 "attempting tailscale certificate renewal..."
        if ! try_renew; then
          echo 1>&2 "renewal failed :("
          exit 1
        fi
        install_certificates
        echo 1>&2 "successfully renewed certificate :)"
      else
        echo 1>&2 "renewal not yet necessary."
      fi
    '';
  in {
    after = [ "tailscaled.service" ];
    requires = [ "tailscaled.service" ];
    serviceConfig = {
      ExecStart = lib.mkForce "+${tailscaleRenewScript}";
    };
  };

  security.acme.preliminarySelfsigned = false;

  services.nginx.virtualHosts = {
    "rnrd.eu".locations = {
      # redirect to akkoma on lapin
      "/.well-known/webfinger" = {
        return = "301 https://soc.rnrd.eu$request_uri";  
      };

      # delegate matrix to lapin
      "/.well-known/matrix/server" = {
        return = "200 '{ \"m.server\": \"matrix.rnrd.eu:443\" }'";
        extraConfig = ''
          default_type application/json;
        '';
      };
      "/.well-known/matrix/client" = {
        return = "200 '{ \"m.homeserver\": { \"base_url\": \"https://matrix.rnrd.eu\" } }'";
        extraConfig = ''
          default_type application/json;
          add_header "Access-Control-Allow-Origin" *;
        '';
      };
    };

    # tailnet internal vhost
    "renard" = {
      forceSSL = true;
      enableACME = true;
      serverName = "renard.serval-moth.ts.net";
      listenAddresses = [ "100.75.17.75" ];
      # point to the default page, for now!
      locations."/" = { alias = "/var/www/html/"; };
    };

    "sho.rest" = {
      enableACME = true;
      forceSSL = true;
      locations."/" = {
        proxyPass = "http://127.0.0.1:5000";
      };
    };

    "mel.gg" = {
      enableACME = true;
      forceSSL = true;
      root = "/srv/mel";
    };

    "git.rnrd.eu" = {
      enableACME = true;
      forceSSL = true;
      locations = {
        "/" = {
          proxyPass = "http://127.0.0.1:3792";
        };

        "/static/" = {
          alias = "/srv/cgit/static/";
        };
      };
    };
  };

  system.stateVersion = "24.05";
}