{ config, self, lib, pkgs,  ... }:

with lib;

{
  sops.defaultSopsFile = ./secrets.yaml;
  sops.secrets = {
    nextcloudAdminPass = {
      owner = "nextcloud";
      group = "nextcloud";
    };
  };

  networking = {
    hostName = mkDefault "nextcloud";
    useDHCP = false;
  };

  imports = [
    self.nixosModules.malobeo.metrics
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
    ../modules/minimal_tools.nix
    ../modules/autoupdate.nix
  ];

  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
    logNginx = true;
    lokiHost = "10.0.0.14";
  };

  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud31;
    hostName = "cloud.malobeo.org";
    config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
    #https = true; #disable for testing
    datadir = "/data/services/nextcloud/";
    database.createLocally = true;
    config.dbtype = "pgsql";
    configureRedis = true;
    caching = {
      redis = true;
      apcu = true;
    };
    extraAppsEnable = true;
    extraApps = {
      inherit (config.services.nextcloud.package.packages.apps) contacts calendar deck polls registration collectives forms;
      appointments = pkgs.fetchNextcloudApp {
        sha256 = "sha256-ls1rLnsX7U9wo2WkEtzhrvliTcWUl6LWXolE/9etJ78=";
        url = "https://github.com/SergeyMosin/Appointments/raw/refs/tags/v2.4.3/build/artifacts/appstore/appointments.tar.gz";
        license = "agpl3Plus";
      };
    };
    settings = {
      trusted_domains = ["10.0.0.13"];
      trusted_proxies = [ "10.0.0.1" ];
      "maintenance_window_start" = "1";
      "default_phone_region" = "DE";
    };
    phpOptions = {
      "realpath_cache_size" = "0";
      "opcache.interned_strings_buffer" = "32";
    };
  };

  networking.firewall.allowedTCPPorts = [ 80 443 ];

  system.stateVersion = "22.11"; # Did you read the comment?
}