{ config, pkgs, ... }:
let 
  app = "shaarli";
  dataDir = "/var/www/${app}";
in {
  services.nginx = {
    enable = true;
    virtualHosts = {
      "192.168.1.6:1232" = {
        forceSSL = false;
        enableACME = false;
        #root = pkgs.shaarli;
	root = dataDir;
        listen = [ { addr = "192.168.1.6"; port = 1232; } ];
	 extraConfig = ''
           index index.php;
	'';
        locations = {
          "/".index = "index.php";

          "~ /\\.".extraConfig = ''
            log_not_found off;
            deny all;
          '';

          "~ (index)\\.php$".extraConfig = ''
	    try_files $uri =404
            include ${pkgs.nginx}/conf/fastcgi.conf;
            fastcgi_split_path_info ^(.+\.php)(/.*)$;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	    fastcgi_param SHAARLI_CONFIG /var/www/shaarli/config;

            fastcgi_pass unix:${config.services.phpfpm.pools.${app}.socket};
            fastcgi_index index.php;
          '';

          "^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;";

          "~ \\.php$".extraConfig = ''
            deny all;
          '';

          "^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;";

          "~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = ''
            expires max;
            add_header Pragma public;
            add_header Cache-Control "public, must-revalidate, proxy-revalidate";
          '';
        };
      };
    };
  };
  services.phpfpm.pools.${app} = {
    user = app;
    #listen = "/run/phpfpm/shaarli.sock";
    settings = { 
      "listen.owner" = config.services.nginx.user;
      "pm" = "dynamic";
      "pm.max_children" = 4;
      "pm.start_servers" = 2;
      "pm.min_spare_servers" = 1;
      "pm.max_spare_servers" = 4;
      "pm.max_requests" = 32;
      "php_admin_value[error_log]" = "stderr";
      "php_admin_flag[log_errors]" = true;
    };
  };
  systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
    users.users.${app} = {
    isSystemUser = true;
    createHome = true;
    home = dataDir;
    group  = app;
  };
  users.groups.${app} = {};
  networking.firewall.allowedTCPPorts = [ 1232 ];
}