{ config, lib, pkgs, ... }:
let
  cfg = config.services.hedgedoc;
in
{
  services.postgresql = {
    enable = true;
    ensureDatabases = [ "hedgedoc" ];
    ensureUsers = lib.singleton {
      name = "codimd";
      ensurePermissions = {
        "DATABASE hedgedoc" = "ALL PRIVILEGES";
      };
    };
  };

  services.hedgedoc = {
    enable = true;
    configuration = {
      host = "127.0.0.1";
      port = 3001;
      db = {
        dialect = "postgres";
        host = "/run/postgresql";
        #user = "hedgedoc";
        database = "hedgedoc";
      };
      domain = "pad.sbruder.de";
      protocolUseSSL = true;
      csp.enable = true;
      imageUploadType = "filesystem";
      uploadsPath = "/data/hedgedoc/uploads";
    };
  };

  systemd.services.hedgedoc = {
    after = [ "postgresql.service" ];
    preStart = toString (pkgs.writeShellScript "hedgedoc-generate-session-secret" ''
      if [ ! -f ${cfg.workDir}/session_secret_env ]; then
          echo "CMD_SESSION_SECRET=$(${pkgs.pwgen}/bin/pwgen -s 32 1)" > ${cfg.workDir}/session_secret_env
      fi
    '');
    serviceConfig = {
      Environment = [
        "CMD_LOGLEVEL=warn"
      ];
      EnvironmentFile = [
        "-${cfg.workDir}/session_secret_env" # - ensures that it will not fail on first start
      ];
    };
  };

  systemd.tmpfiles.rules = [
    "d ${cfg.configuration.uploadsPath} 0700 codimd codimd - -"
  ];

  services.nginx.virtualHosts."pad.sbruder.de" = {
    enableACME = true;
    forceSSL = true;

    locations."/".proxyPass = "http://${cfg.configuration.host}:${toString cfg.configuration.port}";
  };
}