{ self, config, lib, pkgs, ... }:

with lib;

let
  cfg = config.services.gpodder;
in
{
  options = {

    services.gpodder = {
      enable = mkEnableOption "A gpodder instance";

      user = mkOption {
        type = types.str;
        default = "gpodder";
        description = "User account under which gpodder runs.";
      };

      group = mkOption {
        type = types.str;
        default = "gpodder";
        description = "Group account under which gpodder runs.";
      };

      hostname = mkOption {
        type = types.str;
        description = "Hostname of your gpodder service";
      };

      dataFolder = mkOption {
        type = types.str;
        default = "/var/lib/gpodder";
        description = "State director";
      };

      VERIFIER_SECRET_KEY = mkOption {
        type = types.str;
        default = "satnheiycglsrcgaecrlufg";
        description = "Verifer Secret";
      };

    };
  };

  config = mkIf cfg.enable {
    systemd.services.gpodder = {
      description = "gpodder2go A gpodder instance";
      after = [ "remote-fs.target" "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        ExecStart = "${pkgs.gpodder2go}/bin/gpodder2go serve";
        Environment = [
          "VERIFIER_SECRET_KEY=${cfg.VERIFIER_SECRET_KEY}"
        ];
        WorkingDirectory = cfg.dataFolder;
        TimeoutStopSec = " 20 ";
        KillMode = " process ";
        RestartSec = " 10 ";
        User = cfg.user;
        Group = cfg.group;
        DevicePolicy = " closed ";
        NoNewPrivileges = " yes ";
        PrivateTmp = " yes ";
        PrivateUsers = " yes ";
        ProtectControlGroups = " yes ";
        ProtectKernelModules = " yes ";
        ProtectKernelTunables = " yes ";
        RestrictAddressFamilies = "
          AF_UNIX
          AF_INET
          AF_INET6 ";
        RestrictNamespaces = " yes ";
        RestrictRealtime = " yes ";
        SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
        ReadWritePaths = cfg.dataFolder;
        StateDirectory = baseNameOf cfg.dataFolder;
      };
    };

    users.users = optionalAttrs (cfg.user == "gpodder") ({
      gpodder = {
        description = "gpodder service user";
        name = cfg.user;
        group = cfg.group;
        isSystemUser = true;
      };
    });

    users.groups = optionalAttrs (cfg.group == "gpodder") ({
      gpodder = { };
    });

    # systemd.services.gpodder-install = {
    #   description = "gpodder install service";
    #   wantedBy = [ "multi-user.target" ];
    #   before = [ "gpodder.service" ];
    #   path = with pkgs; [ gpodder2go ];

    #   serviceConfig = {
    #     User = cfg.user;
    #     Type = "oneshot";
    #     CacheDirectory = "gpodder";
    #     # Stores sessions.
    #     CacheDirectoryMode = "700";
    #     ConfigurationDirectory = "gpodder";
    #     LogsDirectory = "gpodder";
    #     StateDirectory = "gpodder";
    #   };

    #   script = ''
    #   if [ ! -f "${cfg.dataFolder}/installed" ]; then
    #     ${pkgs.gpodder2go}/bin/gpodder2go init
    #     touch "${cfg.dataFolder}/installed"
    #   fi
    # '';
    # };
  };
}