{inputs, pkgs, config, ...}:

{
  sops.secrets."CF_DNS_API_TOKEN" = {
    format = "json";
    sopsFile = "${inputs.secrets}/mirror/nginx.json";
  };

  sops.secrets."CF_ZONE_API_TOKEN" = {
    format = "json";
    sopsFile = "${inputs.secrets}/mirror/nginx.json";
  };

  sops.templates."ACME.env".content = ''
    CF_DNS_API_TOKEN="${config.sops.placeholder."CF_DNS_API_TOKEN"}"
    CF_ZONE_API_TOKEN="${config.sops.placeholder."CF_ZONE_API_TOKEN"}"
  '';

  networking.firewall.allowedTCPPorts = [
    80 # http
    443 # https
    222 # git ssh
  ];

  security.acme = {
    acceptTerms = true;
    defaults = {
      dnsProvider = "cloudflare";
      environmentFile = config.sops.templates."ACME.env".path;
      email = "nyxerinys5@gmail.com";
    };
  };

  services.nginx = let 
      services = [
        { name = "authentik"; port = "30000"; }
      ];
    in {
    enable = true;
    upstreams = builtins.listToAttrs (builtins.map (
      service:
      {
        name = service.name;
        value = {
          servers = {
            "10.5.0.103:${service.port}" = {};
            "10.5.0.104:${service.port}" = {};
            "10.5.0.105:${service.port}" = {};
          };
        };
      }
    ) services );
    virtualHosts = {
      "vault.nyxerinys.dev" = {
        addSSL = true;
        enableACME = true;
        acmeRoot = null;

        locations."/" = {
          proxyPass = "http://10.5.0.2:83";
          proxyWebsockets = true;
        };
      };
      "auth.nyxerinys.dev" = {
        addSSL = true;
        enableACME = true;
        acmeRoot = null;
        locations."/" = {
          proxyPass = "http://authentik";
          proxyWebsockets = true;
          extraConfig = ''
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $host;
          '';
        };
      };
      "git.nyxerinys.dev" = {
        addSSL = true;
        enableACME = true;
        acmeRoot = null;

        locations."/" = {
          proxyPass = "http://10.5.0.2:3000";
          proxyWebsockets = true;
        };
      };
    };
    streamConfig = ''
      server {
        listen 222;
        proxy_pass 10.5.0.2:222;
      }
    '';
  };
}