{ config, pkgs, lib, ... }:
let
  cfg = config.aether.streams;

  useSubdomain = !(builtins.isNull cfg.subdomain);
  domain = lib.optionalString useSubdomain "${cfg.subdomain}."
           + config.aether.domain;
in {
  imports = [ ./options.nix ];

  environment.systemPackages = [ pkgs.php ];

  services.phpfpm.pools.streams = {
    user = cfg.user;
    settings = {
      "listen.owner" = config.services.nginx.user;
      "pm" = "dynamic";
      "pm.max_children" = 32;
      "pm.max_requests" = 500;
      "pm.start_servers" = 2;
      "pm.min_spare_servers" = 2;
      "pm.max_spare_servers" = 5;
      "php_admin_value[error_log]" = "stderr";
      "php_admin_flag[log_errors]" = true;
      "catch_workers_output" = true;
    };
    phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
  };

  services.nginx.enable = true;
  services.nginx.virtualHosts.${domain} = {
    forceSSL = config.aether.https;
    enableACME = config.aether.https;

    root = cfg.package;

    extraConfig = ''
      index index.php;
      client_max_body_size 512M;

      
      # Rewrite to front controller as default rule.
      location / {
        if (!-e $request_filename) {
          rewrite ^(.*)$ /index.php?req=$1;
        }
      }

      # Make sure webfinger and other well-known services aren't blocked
      # by denying dot files and rewrite request to the front controller.
      location ^~ /.well-known/ {
        allow all;
        if (!-e $request_filename) {
          rewrite ^(.*)$ /index.php?req=$1;
        }
      }

      # Tell where fastcgi lives.
      location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:${config.services.phpfpm.pools.streams.socket};
        include ${config.services.nginx.package}/conf/fastcgi.conf;
      }

      # Block these file types.
      location ~* \.(tpl|tgz|log|out)$ {
        deny all;
      }

      # Block dot files.
      location ~ /\. {
        deny all;
      }

      # Deny access to store.
      location ~ /store {
        deny all;
      }

      # Deny access to util.
      location ~ /util {
        deny all;
      }
    '';
  };

  security.acme.acceptTerms = config.aether.https;
  security.acme.defaults.email = config.aether.acmeEmail;

  networking.firewall.allowedTCPPorts = [ 80 443 ];

  systemd.tmpfiles.rules = [
    "d /var/lib/streams - ${cfg.user} ${cfg.user} - -"
    "d /var/lib/streams/store - ${cfg.user} ${cfg.user} - -"
    "d /var/lib/streams/cache - ${cfg.user} ${cfg.user} - -"
    "d /var/lib/streams/cache/smarty3 - ${cfg.user} ${cfg.user} - -"
  ];

  services.postgresql = {
    enable = true;
    ensureUsers = [{
      name = cfg.user;
      ensureDBOwnership = true;
    }];
    ensureDatabases = [ cfg.user ];
  };

  systemd.timers.streams-daemon = {
    after = [ "network.target" ];
    wantedBy = [ "multi-user.target" ];
    timerConfig.OnCalendar = "*:0/10";
  };
  systemd.services.streams-daemon = {
    serviceConfig = {
      Type = "oneshot";
      User = cfg.user;
    };
    path = [ pkgs.php ];
    script = ''
      cd ${cfg.package}
      php src/Daemon/Run.php Cron >/dev/null 2>&1
    '';
  };

  users.users = lib.mkIf cfg.createUser {
    ${cfg.user} = {
      home = "/var/lib/streams";
      group = cfg.user;
      isSystemUser = true;
    };
  };
  users.groups = lib.mkIf cfg.createUser {
    ${cfg.user} = {};
  };
}