{ config, lib, pkgs, ... }:

let
  phppoolName = "shaarli";
  dataDir = "/var/lib/shaarli";
  vhost = "192.168.1.6:1233";

  shaarli = pkgs.callPackage ./pkg-shaarli.nix {
    inherit dataDir;
  };
in
{
  services.nginx.virtualHosts."${vhost}" = {
    forceSSL = false;
    enableACME = false;
    root = "${shaarli}";
    listen = [ { addr = "192.168.1.6"; port = 1233; } ];
   # extraConfig = ''
   #   index index.php;
   #   '';
    locations."/" = {
      index = "index.php";
      extraConfig = ''
        try_files $uri $uri/ index.php;
        '';
    };
    locations."~ (index)\.php$" = {
      extraConfig = ''
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        if (!-f $document_root$fastcgi_script_name) {
        return 404;
        }

        include ${pkgs.nginx}/conf/fastcgi.conf;
        fastcgi_pass unix:${config.services.phpfpm.pools."${phppoolName}".socket};
        fastcgi_index index.php;
        '';
    };
    locations."~ \.php$" = {
      extraConfig = ''
        deny all;
        '';
    };
  };
  services.phpfpm.pools."${phppoolName}" = {
    user = "nginx";
    group = "nginx";
    settings = {
      "listen.owner" = "nginx";
      "listen.group" = "nginx";
      "user" = "nginx";
      "pm" = "dynamic";
      "pm.max_children" = "75";
      "pm.min_spare_servers" = "5";
      "pm.max_spare_servers" = "20";
      "pm.max_requests" = "10";
      "catch_workers_output" = "1";
    };
  };
  users.extraUsers.shaarli = { group = "shaarli"; };
  users.extraGroups.shaarli = { };
  systemd.services.shaarli-install = {
    serviceConfig.Type = "oneshot";
    wantedBy = [ "multi-user.target" ];
    script = ''
      if [ ! -d "${dataDir}" ]; then
        mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
        cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/cache/
        cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/data/
        cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
        cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/tmp/
      fi
      chown -Rc nginx:nginx ${dataDir}
      find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
      find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
    '';
  };

  networking.firewall.allowedTCPPorts = [ 1233 ];
}