{ pkgs, ... }:

let
  proxyVhost = { upstream, websockets ? true, maxBodySize ? "1g" }: {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = upstream;
      proxyWebsockets = websockets;
      extraConfig = ''
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600;
        proxy_send_timeout 3600;
        proxy_buffering off;
        client_max_body_size ${maxBodySize};
      '';
    };
  };

  dockerService = { name, description, dir }: {
    inherit description;
    after = [ "docker.service" "network.target" ];
    requires = [ "docker.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      WorkingDirectory = dir;
      ExecStart = "${pkgs.docker-compose}/bin/docker-compose up -d --build";
      ExecStop = "${pkgs.docker-compose}/bin/docker-compose down";
    };
  };
in
{
  services.nfs.server = {
    enable = true;
    statdPort = 4000;
    lockdPort = 4001;
    mountdPort = 4002;
    exports = ''
      /media  192.168.50.0/24(rw,sync,no_subtree_check,all_squash,anonuid=1000,anongid=1000,fsid=0)
    '';
  };

  services.jellyfin.enable = true;

  services.tailscale = {
    enable = true;
    openFirewall = true;
    useRoutingFeatures = "server";
  };

  services.syncthing = {
    enable = true;
    user = "ulve";
    dataDir = "/home/ulve";
    configDir = "/home/ulve/.config/syncthing";
    openDefaultPorts = true;
    settings.devices."macbook" = {
      id = "U4YVRUT-JAAXHQ4-TA6FAGH-SO6Z7CI-KDFPRNG-UZYNXDK-6OQY7ZA-UBTZRQW";
    };
    settings.devices."phone" = {
      id = "WXTP2PT-GW3C3EJ-JYYYXUT-VEKCAQV-NQTPQLI-TOMDAI3-CSUUHF5-6DH72AM";
    };
    settings.folders."Downloads" = {
      path = "/home/ulve/Downloads";
      devices = [ "macbook" ];
    };
    settings.folders."yrw8u-ut036" = {
      path = "/home/ulve/Phone";
      devices = [ "phone" ];
    };
    settings.folders."xdnt7-iaqtd" = {
      path = "/home/ulve/Vaults";
      devices = [ "macbook" ];
    };
  };

  services.immich = {
    enable = true;
    mediaLocation = "/media/immich";
  };

  virtualisation.docker = {
    enable = true;
    enableOnBoot = true;
  };

  systemd.services.transmission = dockerService {
    name = "transmission";
    description = "Transmission via Mullvad VPN";
    dir = "/home/ulve/code/transmission";
  };

  systemd.services.aftersummer = dockerService {
    name = "aftersummer";
    description = "Aftersummer";
    dir = "/home/ulve/code/aftersummer";
  };

  systemd.services.spine = dockerService {
    name = "spine";
    description = "Spine ebook server";
    dir = "/home/ulve/code/wargaming";
  };

  systemd.services.bookthing = dockerService {
    name = "bookthing";
    description = "Bookthing audiobook server";
    dir = "/home/ulve/code/bookthing";
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "johansson.olov@gmail.com";
  };

  services.nginx = {
    enable = true;
    virtualHosts."transmission.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:9091"; };
    virtualHosts."aftersummer.maybec.at"  = proxyVhost { upstream = "http://127.0.0.1:5588"; };
    virtualHosts."spine.maybec.at"       = proxyVhost { upstream = "http://localhost:3000"; };
    virtualHosts."bookthing.maybec.at"   = proxyVhost { upstream = "http://127.0.0.1:8000"; };
    virtualHosts."jelly.maybec.at"       = proxyVhost { upstream = "http://127.0.0.1:8096"; };
    virtualHosts."photos.maybec.at"      = proxyVhost { upstream = "http://[::1]:2283"; maxBodySize = "50g"; };
  };
}