{ self, pkgs, config, lib, ... }:

{
  # age.secrets.wallabag-password.file = "${self}/secrets/wallabag-password.age";
  # age.secrets.wallabag-secret.file = "${self}/secrets/wallabag-secret.age";
  # age.secrets.wallabag-password.owner = "wallabag";
  # age.secrets.wallabag-secret.owner = "wallabag";
  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_11;

    # Ensure the database, user, and permissions always exist
    ensureDatabases = [ "wallabag" ];
    ensureUsers = [
      {
        name = "wallabag";
        ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES";
      }
    ];
  };

  services.wallabag = {
    enable = true;
    hostName = "read.mossnet.lan";
    package = pkgs.wallabag;
    conf = ''
      # This file is a "template" of what your parameters.yml file should look like
      parameters:
          database_driver: pdo_pgsql
          database_host: localhost
          database_port: ~
          database_name: wallabag
          database_user: wallabag
          database_password: wallabag 
          # For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
          database_path: ~
          database_table_prefix: wallabag_
          database_socket: null
          # with PostgreSQL and SQLite, you must set "utf8"
          database_charset: utf8

          domain_name: http://read.mossnet.lan
          server_name: "mossnet wallabag instance"

          mailer_transport:  smtp
          mailer_user:       ~
          mailer_password:   ~
          mailer_host:       127.0.0.1
          mailer_port:       false
          mailer_encryption: ~
          mailer_auth_mode:  ~

          locale: en

          # A secret key that's used to generate certain security-related tokens
          secret: SAFGOECRIlfal89oe6u0(*^dsaaih961

          # two factor stuff
          twofactor_auth: true
          twofactor_sender: no-reply@wallabag.org

          # fosuser stuff
          fosuser_registration: true
          fosuser_confirmation: true

          # how long the access token should live in seconds for the API
          fos_oauth_server_access_token_lifetime: 3600
          # how long the refresh token should life in seconds for the API
          fos_oauth_server_refresh_token_lifetime: 1209600

          from_email: ops@sealight.xyz

          rss_limit: 50

          # RabbitMQ processing
          rabbitmq_host: localhost
          rabbitmq_port: 5672
          rabbitmq_user: guest
          rabbitmq_password: guest
          rabbitmq_prefetch_count: 10

          # Redis processing
          redis_scheme: tcp
          redis_host: localhost
          redis_port: 6379
          redis_path: null
          redis_password: null

          # sentry logging
          sentry_dsn: ~
    '';
  };
  # networking.firewall.allowedTCPPorts = [ 8080 ];
}