{ self, config, lib, pkgs, ... }:

with lib;

let
  cfg = config.services.gpodder2go;
in
{
  options = {

    services.gpodder = {
      enable = mkEnableOption "A gpodder instance";

      user = mkOption {
        type = types.str;
        default = "gpodder";
        description = "User account under which gpodder runs.";
      };

      group = mkOption {
        type = types.str;
        default = "gpodder";
        description = "Group account under which gpodder runs.";
      };

      hostname = mkOption {
        type = types.str;
        description = "Hostname of your gpodder service";
      };

      dataFolder = mkOption {
        type = types.str;
        default = "/var/lib/gpodder";
        description = "State director";
      };

      VERIFIER_SECRET_KEY = mkOption {
        type = types.str;
        default = "satnheiycglsrcgaecrlufg";
        description = "Verifer Secret";
      };

    };
  };

  config = mkIf cfg.enable {
    systemd.services.gpodder = {
      description = "gpodder2go A gpodder instance";
      after = [ "remote-fs.target" "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        ExecStart = "${pkgs.gpodder2go}/bin/gpodder2go serve";
        Environment = [
          "VERIFIER_SECRET_KEY=${cfg.VERIFIER_SECRET_KEY}"
        ];
        WorkingDirectory = dataFolder;
        TimeoutStopSec = " 20 ";
        KillMode = " process ";
        RestartSec = " 10 ";
        User = cfg.user;
        Group = cfg.group;
        DevicePolicy = " closed ";
        NoNewPrivileges = " yes ";
        PrivateTmp = " yes ";
        PrivateUsers = " yes ";
        ProtectControlGroups = " yes ";
        ProtectKernelModules = " yes ";
        ProtectKernelTunables = " yes ";
        RestrictAddressFamilies = "
          AF_UNIX
          AF_INET
          AF_INET6 ";
        RestrictNamespaces = " yes ";
        RestrictRealtime = " yes ";
        SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
        ReadWritePaths = dataFolder;
        StateDirectory = baseNameOf dataFolder;
      };
    };

    users.users = optionalAttrs (cfg.user == "gpodder") ({
      gpodder = {
        description = "gpodder service user";
        name = cfg.user;
        group = cfg.group;
        isSystemUser = true;
      };
    });

    users.groups = optionalAttrs (cfg.group == "gpodder") ({
      gpodder = { };
    });
  };

  systemd.services.gpodder-install = {
    description = "gpodder install service";
    wantedBy = [ "multi-user.target" ];
    before = [ "gpodder.service" ];
    path = with pkgs; [ gpodder2go ];

    serviceConfig = {
      User = cfg.user;
      Type = "oneshot";
    } // commonServiceConfig;

    script = ''
    if [ ! -f "${cfg.dataFolder}/installed" ]; then
      ${pkgs.gpodder2go}/bin/gpodder2go init
      touch "${cfg.dataFolder}/installed"
    fi
  '';
  };
}