{ config, pkgs, lib, ... }:

let
  autodeploy = pkgs.buildGoModule {
    name = "autodeploy";
    src = ./autodeploy;
    vendorHash = "sha256-H8Wa1GoXjU8mkaE0ofdA1mO+rNo3l4s0nxTVih9LuWs=";
  };

  buildScript = ''
      rev=$(git ls-remote https://git.orga.cebula.camp/infra/site | grep refs/heads/nix | cut -f1)
      pkg=$(nix-build -I nixpkgs=${pkgs.path} --no-out-link -E 'import (builtins.fetchGit { url = "https://git.orga.cebula.camp/infra/site"; rev="'$rev'"; })')
  '';
in {
  services.nginx.virtualHosts."cebula.camp" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://localhost:3000/";
      proxyWebsockets = true;
    };
    locations."/.not-well-known/update" = {
      proxyPass = "http://unix:/run/site-autodeploy.sock";
      extraConfig = ''
        proxy_http_version 1.0;
      '';
    };
  };
  systemd.sockets.site-autodeploy = {
    wantedBy = [ "sockets.target" ];
    socketConfig = {
      ListenStream = "/run/site-autodeploy.sock";
      SocketMode = "0600";
      SocketUser = config.services.nginx.user;
      Accept = true;
      MaxConnections=1;
    };
  };
  systemd.services."site-autodeploy@" = {
    path = [ pkgs.git pkgs.nix pkgs.bash pkgs.systemd ];
    script = ''
      set -eu
      rev=$(git ls-remote https://git.orga.cebula.camp/infra/site | grep refs/heads/nix | cut -f1)
      if [ -n "$(nix-build --dry-run -I nixpkgs=${pkgs.path} -E 'import (builtins.fetchGit { url = "https://git.orga.cebula.camp/infra/site"; rev="'$rev'"; })' 2>&1)" ]; then
        echo -e "HTTP/1.0 200 Ok\r\n\r\n\r\n"
        ${buildScript}
        systemctl restart cebula-site
      else
        echo -e "HTTP/1.0 304 Not Modified\r\nContent-Length: 0\r\n\r\n"
      fi
    '';
    unitConfig = {
      CollectMode="inactive-or-failed";
    };
    serviceConfig = {
      Type = "oneshot";
      # TODO: run as an unprivileged user:
      # 1. figure out why rootless podman is broken, probaby something with
      #    subuid/subgid maps with LDAP.
      # 2. let the unprivileged user sudo into a systemctl unit restart
      User = "root";
      StandardOutput = "socket";
    };
  };
  systemd.services.cebula-site = {
    wantedBy = [ "multi-user.target" ];
    path = [ pkgs.git pkgs.nix pkgs.bash ];
    script = ''
      ${buildScript}
      exec $pkg/bin/cebula-site
    '';
  };
}