{ config, lib, pkgs, ... }:

let
  botConfig = pkgs.writeText "ntfy-matrix-bot.toml" ''
    matrix_homeserver = "https://conduit.stuebinm.eu"
    matrix_username = "testbot"
    matrix_rooms = [ "#test:conduit.stuebinm.eu" ]
    ntfy_server = "https://ping.stuebinm.eu"
    ntfy_topics = [ "monit" ]
  '';
in
{
  services.matrix-conduit = {
    enable = true;

    extraEnvironment.RUST_BACKTRACE = "yes";
    settings.global = {
      server_name = "conduit.stuebinm.eu";
      trusted_servers = [  ]; # TODO what does this mean?
      port = 6167;
      allow_registration = false;
    };
  };

  sops.secrets."ntfy-matrix-bot/env" = {};

  systemd.services.ntfy-matrix-bot = {
    enable = true;
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      ExecStart = "${lib.getExe pkgs.ntfy-matrix-bot} -c ${botConfig}";
      Type = "simple";
      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
      DynamicUser = true;
      BindPaths = botConfig;
      EnvironmentFile = "/run/secrets/ntfy-matrix-bot/env";
      Restart = "always";
    };
    environment.RUST_LOG = "ntfy_matrix_bot=info";
  };

  services.nginx.virtualHosts."conduit.stuebinm.eu" = {
    locations."/_matrix/".proxyPass = "http://localhost:6167";
    enableACME = true;
    forceSSL = true;
    listen = [
      {
        addr = "[::]";
        port = 443;
        ssl = true;
      }
      {
        addr = "[::]";
        port = 8448;
        ssl = true;
      }
    ];
  };

  networking.firewall.allowedTCPPorts = [ 8448 ];
}