{ config, lib, pkgs, ... }:
let
  cfg = config.services.matrix-synapse.settings;

  fqdn = "matrix.sbruder.de";
  domain = "sbruder.de";
in
{
  sops.secrets = {
    synapse-registration-shared-secret = {
      owner = "matrix-synapse";
      sopsFile = ../../secrets.yaml;
    };
    synapse-turn-shared-secret = {
      owner = "matrix-synapse";
      sopsFile = ../../secrets.yaml;
    };
  };
  systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups = lib.singleton "keys";

  services.matrix-synapse = {
    enable = true;

    settings = {
      server_name = domain;
      public_baseurl = "https://${fqdn}";

      listeners = lib.singleton {
        port = 8008;
        bind_addresses = [ "127.0.0.1" ];
        type = "http";
        tls = false;
        x_forwarded = true;
        resources = lib.singleton {
          names = [ "client" "federation" "metrics" ];
          compress = false;
        };
      };

      turn_uris = [
        "turns:turn.sbruder.de:5349?transport=udp"
        "turns:turn.sbruder.de:5349?transport=tcp"
        "turn:turn.sbruder.de:3478?transport=udp"
        "turn:turn.sbruder.de:3478?transport=tcp"
      ];
      turn_user_lifetime = "3600000"; # 1h

      enable_metrics = true;

      # adapted from https://github.com/NixOS/nixpkgs/blob/7e10bf4327491a6ebccbe1aaa8e6c6c0aca4663a/nixos/modules/services/misc/matrix-synapse-log_config.yaml
      #  - set root.level to WARNING instead of INFO
      logConfig = builtins.toJSON {
        version = 1;

        formatters.journal_fmt.format = "%(name)s: [%(request)s] %(message)s";

        filters.context = {
          "()" = "synapse.util.logcontext.LoggingContextFilter";
          request = "";
        };

        handlers.journal = {
          class = "systemd.journal.JournalHandler";
          formatter = "journal_fmt";
          filters = [ "context" ];
          SYSLOG_IDENTIFIER = "synapse";
        };

        root = {
          level = "WARNING";
          handlers = [ "journal" ];
        };

        disable_existing_loggers = false;
      };

      max_upload_size = "50M";

      # I’m okay with using matrix.org as trusted key server
      suppress_key_server_warning = true;
    };

    extraConfigFiles = with config.sops.secrets; [
      synapse-registration-shared-secret.path
      synapse-turn-shared-secret.path
    ];
  };

  services.postgresql = {
    enable = true;
    # synapse requires custom databse configuration:
    # CREATE DATABASE "matrix-synapse" TEMPLATE template0 LC_COLLATE "C" LC_CTYPE "C";
    ensureUsers = lib.singleton {
      name = "matrix-synapse";
      ensurePermissions = {
        "DATABASE \"matrix-synapse\"" = "ALL PRIVILEGES";
      };
    };
  };

  services.nginx.virtualHosts = {
    "${fqdn}" = {
      enableACME = true;
      forceSSL = true;

      locations."/".return = "301 https://chat.sbruder.de";

      locations."/_matrix" =
        let
          listenerCfg = (lib.elemAt cfg.listeners 0);
        in
        {
          proxyPass = "http://${lib.elemAt listenerCfg.bind_addresses 0}:${toString listenerCfg.port}";

          extraConfig = ''
            client_max_body_size ${cfg.max_upload_size};
          '';
        };
    };

    "${domain}" = {
      enableACME = true;
      forceSSL = true;

      locations =
        let
          # workaround for nginx dropping parent headers
          # see https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
          parentHeaders = lib.concatStringsSep "\n" (lib.filter
            (lib.hasPrefix "add_header ")
            (lib.splitString "\n" config.services.nginx.commonHttpConfig));
        in
        {
          "=/.well-known/matrix/server".extraConfig = ''
            ${parentHeaders}
            add_header Content-Type application/json;
            return 200 '${builtins.toJSON {
              "m.server" = "${fqdn}:443";
              }}';
          '';
          "=/.well-known/matrix/client".extraConfig = ''
            ${parentHeaders}
            add_header Content-Type application/json;
            add_header Access-Control-Allow-Origin *;
            return 200 '${builtins.toJSON {
              "m.homeserver"."base_url" = "https://${fqdn}";
            }}';
          '';
        };
    };
  };
}