{ config, self, lib, pkgs,  ... }:

with lib;

let
  hosts = import ../hosts.nix {};
in
{
  sops.defaultSopsFile = ./secrets.yaml;
  sops.secrets = {
    nextcloudAdminPass = {
      owner = "nextcloud";
      group = "nextcloud";
    };
  };

  networking = {
    hostName = mkDefault "nextcloud";
    useDHCP = false;
  };

  imports = [
    self.nixosModules.malobeo.metrics
    ../modules/malobeo_user.nix
    ../modules/sshd.nix
    ../modules/minimal_tools.nix
    ../modules/autoupdate.nix
  ];

  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
    logNginx = true;
  };

  services.postgresqlBackup = {
    enable = true;
  };

  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud33;
    hostName = "cloud.malobeo.org";
    config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
    maxUploadSize = "10G";
    datadir = "/data/services/nextcloud/";
    database.createLocally = true;
    config.dbtype = "pgsql";
    configureRedis = true;
    caching = {
      redis = true;
      apcu = true;
    };
    extraAppsEnable = true;
    extraApps = {
      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
      deck = pkgs.php.buildComposerProject2 (finalAttrs: {
        pname = "deck";
        version = "1.18.0";
        src = pkgs.fetchFromGitHub {
          owner = "nextcloud";
          repo = "deck";
          rev = "stable33";
          hash = "sha256-7R0IteB34mWFwUlHptvqNlfmeFhJcGMRlKFtDqsw1Dw=";
        };
        composerNoDev = false;
        composerStrictValidation = false;
        vendorHash = "sha256-gAuG5kKVpuaOpw2HvAP/hu89lmcVWUiSwujoN++I/ZA=";
        patches = [ ./0001-Patch-cards-to-be-draggable.patch ];
        postInstall = ''
          cp -r $out/share/php/deck/* $out/
          rm -r $out/share
        '';
      });
    };
    settings = {
      trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
      trusted_proxies = [ hosts.malobeo.hosts.fanny.network.address ];
      overwriteprotocol = "https";
      "maintenance_window_start" = "1";
      "default_phone_region" = "DE";
    };
    phpOptions = {
      "realpath_cache_size" = "0";
      "opcache.interned_strings_buffer" = "32";
    };
  };

  networking.firewall.allowedTCPPorts = [ 80 443 ];

  system.stateVersion = "22.11"; # Did you read the comment?
}