{ auxiliaryPkgs, ... }:

let
  inherit (auxiliaryPkgs) common;

  # next to vanilla! a srv dns record handles the routing
  # from `p2.mc.rnrd.eu` to here.
  p2Port = 25566;
  p2Directory = "/srv/mc-p2";
  p2Memory = "8G";

  p2Image = common.pullImage {
    name = "itzg/minecraft-server";
    tag = "2026.9.0-java17"; # fabric, 1.20.1, java 17
    digest = "sha256:40f4721c1e6020164e5b7eed81c844734ca4ae8339f6546869edc48be82f82dc";
    x86.sha256 = "sha256-M8sHIOegqJsMYvk2Lnc6Zwkj9NO30hgf67OscjpW7KE=";
  };

in
{
  networking.firewall.allowedTCPPorts = [ p2Port ];

  foundation.services.minecraft-p2 = {
    fullImage = p2Image;

    ports = [ (common.globalPort [ p2Port 25565 ]) ];

    volumes = [ [ "${p2Directory}" "/data" ] ];

    environment = {
      EULA = "TRUE";

      # image can configure everything by itself! (woah!)
      TYPE = "MODRINTH";
      MODRINTH_MODPACK = "prominence-2-fabric";
      MODRINTH_VERSION = "4.0.4"; # id: v5JSKaF2
      MODRINTH_LOADER = "fabric";

      # 4.0.4 needs s_lib but decided to not package it properly for servers. :(
      # this can be dropped once it's fixed in upstream!
      MODRINTH_PROJECTS = "s-lib:qf2mIL1z";

      MEMORY = p2Memory;

      OVERRIDE_SERVER_PROPERTIES = "false"; # configs are managed by hand

      # runs as root, so the mounted files are root-owned too,
      # created as 0755/0644 to match the mount point itself.
      UID = "0";
      GID = "0";
      UMASK = "0022";
    };
  };
}