{ pkgs, ... }:

let
  proxyVhost = { upstream, websockets ? true, maxBodySize ? "1g" }: {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = upstream;
      proxyWebsockets = websockets;
      extraConfig = ''
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600;
        proxy_send_timeout 3600;
        proxy_buffering off;
        client_max_body_size ${maxBodySize};
      '';
    };
  };

  dockerService = { name, description, dir }: {
    inherit description;
    after = [ "docker.service" "network.target" ];
    requires = [ "docker.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      WorkingDirectory = dir;
      ExecStart = "${pkgs.docker-compose}/bin/docker-compose up -d --build";
      ExecStop = "${pkgs.docker-compose}/bin/docker-compose down";
    };
  };
in
{
  services.jellyfin.enable = true;

  services.tailscale = {
    enable = true;
    openFirewall = true;
    useRoutingFeatures = "server";
  };

  services.immich = {
    enable = true;
    mediaLocation = "/media/immich";
  };

  virtualisation.docker = {
    enable = true;
    enableOnBoot = true;
  };

  systemd.services.transmission = dockerService {
    name = "transmission";
    description = "Transmission via Mullvad VPN";
    dir = "/home/ulve/code/transmission";
  };

  systemd.services.aftersummer = dockerService {
    name = "aftersummer";
    description = "Aftersummer";
    dir = "/home/ulve/code/aftersummer";
  };

  systemd.services.spine = dockerService {
    name = "spine";
    description = "Spine ebook server";
    dir = "/home/ulve/code/wargaming";
  };

  systemd.services.bookthing = dockerService {
    name = "bookthing";
    description = "Bookthing audiobook server";
    dir = "/home/ulve/code/bookthing";
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "johansson.olov@gmail.com";
  };

  services.nginx = {
    enable = true;
    virtualHosts."transmission.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:9091"; };
    virtualHosts."aftersummer.maybec.at"  = proxyVhost { upstream = "http://127.0.0.1:5588"; };
    virtualHosts."spine.maybec.at"       = proxyVhost { upstream = "http://localhost:3000"; };
    virtualHosts."bookthing.maybec.at"   = proxyVhost { upstream = "http://127.0.0.1:8000"; };
    virtualHosts."jelly.maybec.at"       = proxyVhost { upstream = "http://127.0.0.1:8096"; };
    virtualHosts."photos.maybec.at"      = proxyVhost { upstream = "http://[::1]:2283"; maxBodySize = "50g"; };
  };
}