{ pkgs, ... }:

let
  domain = "matrix.giugl.io";
  webui_domain = "chat.giugl.io";
  network = import ./network.nix;
in {
  services = {
    matrix-synapse = {
      enable = true;
      settings = {
        server_name = "${domain}";
        database_name = "synapse";
        public_baseurl = "https://${domain}";
        registration_shared_secret = "runas!";
        url_preview_enabled = true;
        dynamic_thumbnails = true;
        withJemalloc = true;
        #      enable_registration = true;
        app_service_config_files = [
          "/var/lib/matrix-synapse/discord-registration.yaml"
          #        "/var/lib/matrix-synapse/hookshot-registration.yml"
          #        "/var/lib/matrix-synapse/telegram-registration.yaml"
        ];
       # log_config = ''
       #   version: 1

       #   # In systemd's journal, loglevel is implicitly stored, so let's omit it
       #   # from the message text.
       #   formatters:
       #       journal_fmt:
       #           format: '%(name)s: [%(request)s] %(message)s'

       #   filters:
       #       context:
       #           (): synapse.util.logcontext.LoggingContextFilter
       #           request: ""

       #   handlers:
       #       journal:
       #           class: systemd.journal.JournalHandler
       #           formatter: journal_fmt
       #           filters: [context]
       #           SYSLOG_IDENTIFIER: synapse

       #   root:
       #       level: WARN
       #       handlers: [journal]

       #   disable_existing_loggers: False
       # '';
        listeners = [{
          port = 8008;
          bind_addresses = ["127.0.0.1"];
          type = "http";
          tls = false;
          x_forwarded = true;
          resources = [{
            names = [ "client" "federation" ];
            compress = false;
          }];
        }];
      };
      
      #extraConfig = ''
      #  auto_join_rooms:
      #    - "#general:matrix.giugl.io"
      #  max_upload_size: "50M"
      #'';
      # turn_uris = [
      #   "turns:turn.giugl.io:5349?transport=udp"
      #   "turns:turn.giugl.io:5349?transport=tcp"
      # ];
      # turn_shared_secret = "69duck duck fuck420";
      # turn_user_lifetime = "1h";
    };

    postgresql = {
      enable = true;
      package = pkgs.postgresql_11;
      ensureDatabases = [ "synapse" ];
      ensureUsers = [{
        name = "matrix-synapse";
        ensurePermissions = { "DATABASE synapse" = "ALL PRIVILEGES"; };
      }];
    };

    nginx.virtualHosts = {
      # server
      ${domain} = {
        enableACME = true;
        forceSSL = true;
        extraConfig = ''
          client_max_body_size  30m;
        '';
        locations."= /.well-known/matrix/server".extraConfig =
          let server = { "m.server" = "${domain}:443"; };
          in ''
            add_header Content-Type application/json;
            return 200 '${builtins.toJSON server}';
          '';

        locations."= /.well-known/matrix/client".extraConfig = let
          client = {
            "m.homeserver" = { "base_url" = "https://${domain}:443"; };
            "m.identity_server" = { "base_url" = "https://vector.im"; };
          };
          # ACAO required to allow element-web on any URL to request this json file
        in ''
          add_header Content-Type application/json;
          add_header Access-Control-Allow-Origin *;
          return 200 '${builtins.toJSON client}';
        '';

        locations."/".extraConfig = ''
          return 404;
        '';

        # forward all Matrix API calls to the synapse Matrix homeserver
        locations."/_matrix" = {
          proxyPass = "http://[::1]:8008"; # without a trailing /
        };
      };

      # web client
      "${webui_domain}" = {
        enableACME = true;
        forceSSL = true;

        root = pkgs.element-web.override {
          conf = {
            default_server_config."m.homeserver" = {
              "base_url" = "https://${domain}";
              "server_name" = "${domain}";
            };
          };
        };
      };
    };

    # discord bridge
    matrix-appservice-discord = {
      enable = true;
      environmentFile = /secrets/matrix-appservice-discord/tokens.env;
      # The appservice is pre-configured to use SQLite by default.
      # It's also possible to use PostgreSQL.
      settings = {
        bridge = {
          domain = domain;
          homeserverUrl = "https://${domain}";
        };
      };
    };

    # telegram bridge

    #   mautrix-telegram = {
    #     enable = true;
    #     environmentFile = /secrets/mautrix-telegram/mautrix-telegram.env;

    #     settings = {
    #       homeserver = {
    #         address = "https://${domain}";
    #         domain = "${domain}";
    #       };

    #       appservice = {
    #         provisioning.enabled = false;
    #         id = "telegram";
    #       };

    #       bridge = {
    #         permissions = {
    #           "@pepe:${domain}" = "admin";
    #           "${domain}" = "puppeting";
    #         };

    #         # Animated stickers conversion requires additional packages in the
    #         # service's path.
    #         # If this isn't a fresh installation, clearing the bridge's uploaded
    #         # file cache might be necessary (make a database backup first!):
    #         # delete from telegram_file where \
    #         #   mime_type in ('application/gzip', 'application/octet-stream')
    #         animated_sticker = {
    #           target = "gif";
    #           args = {
    #             width = 256;
    #             height = 256;
    #             fps = 30; # only for webm
    #             background = "020202"; # only for gif, transparency not supported
    #           };
    #         };

    #         encryption = {
    #           allow = true;
    #           default = true;
    #         };
    #       };
    #     };
    #   };

  };

  # systemd.services.mautrix-telegram.path = with pkgs; [
  #   lottieconverter # for animated stickers conversion, unfree package
  #   ffmpeg # if converting animated stickers to webm (very slow!)
  # ];

  networking.extraHosts = ''
    ${network.architect-lan} ${domain} ${webui_domain}
    ${network.architect-wg} ${domain} ${webui_domain}
  '';

}