{ config, lib, ... }:

let
  inherit (lib) mkIf readFile;

in
{
  imports = [ ./options.nix ];

  config = mkIf (config.fediversity.enable && config.fediversity.peertube.enable) {
    networking.firewall.allowedTCPPorts = [
      80
      443

      ## For Live streaming and Live streaming when RTMPS is enabled.
      1935
      1936
    ];

    fediversity.garage = {
      ensureBuckets = {
        peertube-videos = {
          website = true;
          # TODO: these are too broad, after getting everything works narrow it down to the domain we actually want
          corsRules = {
            enable = true;
            allowedHeaders = [ "*" ];
            allowedMethods = [ "GET" ];
            allowedOrigins = [ "*" ];
          };
        };
        # TODO: these are too broad, after getting everything works narrow it down to the domain we actually want
        peertube-playlists = {
          website = true;
          corsRules = {
            enable = true;
            allowedHeaders = [ "*" ];
            allowedMethods = [ "GET" ];
            allowedOrigins = [ "*" ];
          };
        };
      };

      ensureKeys = {
        peertube = {
          inherit (config.fediversity.peertube) s3AccessKeyFile s3SecretKeyFile;
          ensureAccess = {
            peertube-videos = {
              read = true;
              write = true;
              owner = true;
            };
            peertube-playlists = {
              read = true;
              write = true;
              owner = true;
            };
          };
        };
      };
    };

    services.peertube = {
      enable = true;
      localDomain = config.fediversity.peertube.domain;

      # TODO: in most of nixpkgs, these are true by default. upstream that unless there's a good reason not to.
      redis.createLocally = true;
      database.createLocally = true;

      secrets.secretsFile = config.fediversity.peertube.secretsFile;

      settings = {
        object_storage = {
          enabled = true;
          endpoint = config.fediversity.garage.api.url;
          region = "garage";
          upload_acl.public = null; # Garage does not support ACL
          upload_acl.private = null; # Garage does not support ACL

          # not supported by garage
          # SEE: https://garagehq.deuxfleurs.fr/documentation/connect/apps/#peertube
          proxy.proxyify_private_files = false;

          web_videos = rec {
            bucket_name = "peertube-videos";
            prefix = "";
            base_url = config.fediversity.garage.web.urlForBucket bucket_name;
          };
          videos = rec {
            bucket_name = "peertube-videos";
            prefix = "";
            base_url = config.fediversity.garage.web.urlForBucket bucket_name;
          };
          streaming_playlists = rec {
            bucket_name = "peertube-playlists";
            prefix = "";
            base_url = config.fediversity.garage.web.urlForBucket bucket_name;
          };
        };
      };
      serviceEnvironmentFile = "/etc/peertube-env";
    };

    ## FIXME: secrets management; we should have a service that writes the
    ## `.env` files based on all the secrets that we need to put there.
    environment.etc.peertube-env.text = ''
      AWS_ACCESS_KEY_ID=${readFile config.fediversity.peertube.s3AccessKeyFile}
      AWS_SECRET_ACCESS_KEY=${readFile config.fediversity.peertube.s3SecretKeyFile}
    '';

    ## Proxying through Nginx

    services.peertube = {
      configureNginx = true;
      listenWeb = 443;
      enableWebHttps = true;
    };
    services.nginx.virtualHosts.${config.services.peertube.localDomain} = {
      forceSSL = true;
      enableACME = true;
    };
  };
}