module.nix

# Template & Guide from
# https://github.com/reckenrode/nix-foundryvtt/blob/main/modules/foundryvtt/default.nix
flake: {
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.services.xinux.bot;
  bot = flake.packages.${pkgs.stdenv.hostPlatform.system}.default;

  genArgs = {cfg}: let
    token = cfg.token;
    domain = cfg.webhook.domain or "";
    mode =
      if cfg.webhook.enable
      then "webhook"
      else "polling";
    port =
      if cfg.webhook.enable
      then "--port ${toString cfg.webhook.port}"
      else "";
  in
    lib.strings.concatStringsSep " " [mode token domain port];

  caddy = lib.mkIf (cfg.enable && cfg.webhook.enable && cfg.webhook.proxy == "caddy") {
    services.caddy.virtualHosts = lib.debug.traceIf (builtins.isNull cfg.webhook.domain) "webhook.domain can't be null, please specicy it properly!" {
      "${cfg.webhook.domain}" = {
        extraConfig = ''
          reverse_proxy 127.0.0.1:${toString cfg.webhook.port}
        '';
      };
    };
  };

  nginx = lib.mkIf (cfg.enable && cfg.webhook.enable && cfg.webhook.proxy == "nginx") {
    services.nginx.virtualHosts = lib.debug.traceIf (builtins.isNull cfg.webhook.domain) "webhook.domain can't be null, please specicy it properly!" {
      "${cfg.webhook.domain}" = {
        addSSL = true;
        enableACME = true;
        locations."/" = {
          proxyPass = "http://127.0.0.1:${toString cfg.webhook.port}";
          proxyWebsockets = true;
        };
      };
    };
  };

  service = lib.mkIf cfg.enable {
    users.users.${cfg.user} = {
      description = "Xinux Bot management user";
      isSystemUser = true;
      group = cfg.group;
    };

    users.groups.${cfg.group} = {};

    systemd.services.xinux-bot = {
      description = "Xinux Bot for managing telegram community";
      documentation = ["https://xinux.uz/"];

      after = ["network-online.target"];
      wants = ["network-online.target"];
      wantedBy = ["multi-user.target"];

      serviceConfig = {
        User = cfg.user;
        Group = cfg.group;
        Restart = "always";
        ExecStart = "${lib.getBin cfg.package}/bin/bot ${genArgs {cfg = cfg;}}";
        StateDirectory = cfg.user;
        StateDirectoryMode = "0750";
        # EnvironmentFile = cfg.secret;

        # Hardening
        CapabilityBoundingSet = [
          "AF_NETLINK"
          "AF_INET"
          "AF_INET6"
        ];
        DeviceAllow = ["/dev/stdin r"];
        DevicePolicy = "strict";
        IPAddressAllow = "localhost";
        LockPersonality = true;
        # MemoryDenyWriteExecute = true;
        NoNewPrivileges = true;
        PrivateDevices = true;
        PrivateTmp = true;
        PrivateUsers = true;
        ProtectClock = true;
        ProtectControlGroups = true;
        ProtectHome = true;
        ProtectHostname = true;
        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
        ProtectSystem = "strict";
        ReadOnlyPaths = ["/"];
        RemoveIPC = true;
        RestrictAddressFamilies = [
          "AF_NETLINK"
          "AF_INET"
          "AF_INET6"
        ];
        RestrictNamespaces = true;
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
        SystemCallArchitectures = "native";
        SystemCallFilter = [
          "@system-service"
          "~@privileged"
          "~@resources"
          "@pkey"
        ];
        UMask = "0027";
      };

      # preStart = ''
      #   installedConfigFile="${config.services.xinux.bot.dataDir}/Config/options.json"
      #   install -d -m750 ${config.services.xinux.bot.dataDir}/Config
      #   rm -f "$installedConfigFile" && install -m640 ${configFile} "$installedConfigFile"
      # '';
    };
  };

  asserts = lib.mkIf cfg.enable {
    warnings = [
      (lib.mkIf (cfg.webhook.enable && cfg.webhook.domain == null) "services.xinux.bot.webhook.domain must be set in order to properly generate certificate!")
    ];

    assertions = [
      {
        assertion = cfg.token != null;
        message = "services.xinux.bot.token must be set!";
      }
    ];
  };
in {
  options = with lib; {
    services.xinux.bot = {
      enable = mkEnableOption ''
        Xinux Bot: Telegram bot made by Xinux team for Xinux community.
      '';

      webhook = {
        enable = mkEnableOption ''
          Webhook method of deployment
        '';

        domain = mkOption {
          type = with types; nullOr str;
          default = null;
          example = "xinux.uz";
          description = "Domain to use while adding configurations to web proxy server";
        };

        proxy = mkOption {
          type = with types;
            nullOr (enum [
              "nginx"
              "caddy"
            ]);
          default = "caddy";
          description = "Proxy reverse software for hosting webhook";
        };

        port = mkOption {
          type = types.int;
          default = 8450;
          description = "Port to use for passing over proxy";
        };
      };

      token = mkOption {
        type = with types; nullOr path;
        default = null;
        description = lib.mdDoc ''
          Path to telegram bot token of Xinux manager.
        '';
      };

      user = mkOption {
        type = types.str;
        default = "xinux-bot";
        description = "User for running system + accessing keys";
      };

      group = mkOption {
        type = types.str;
        default = "xinux-bot";
        description = "Group for running system + accessing keys";
      };

      dataDir = mkOption {
        type = types.str;
        default = "/var/lib/xinux/bot";
        description = lib.mdDoc ''
          The path where Xinux Bot keeps its config, data, and logs.
        '';
      };

      package = mkOption {
        type = types.package;
        default = bot;
        description = ''
          The Xinux Bot package to use with the service.
        '';
      };
    };
  };

  config = lib.mkMerge [asserts service caddy nginx];
}