infrastructure/machines/web01/linkal/module.nix

{
  config,
  lib,
  pkgs,
  sources,
  ...
}:

let
  inherit (lib)
    mapAttrs'
    mkEnableOption
    mkIf
    mkOption
    nameValuePair
    types
    ;

  package = import sources.linkal { inherit pkgs; };

  cfg = config.dgn-linkal;

  jsonFormat = pkgs.formats.json { };
in
{
  options.dgn-linkal = {
    enable = mkEnableOption "the linkal server.";

    package = mkOption {
      type = types.package;
      default = package.overrideAttrs (_: { buildInputs = [ ]; });
    };

    domain = mkOption { type = types.str; };

    calendarGroups = mkOption {
      type =
        let
          inherit (types) attrsOf port submodule;
        in
        attrsOf (
          submodule {
            options = {
              port = mkOption { type = port; };
              calendars = mkOption { inherit (jsonFormat) type; };
            };
          }
        );
      default = { };
    };
  };

  config = mkIf cfg.enable {
    systemd.services =
      mapAttrs'
        (
          name:
          { port, calendars }:
          nameValuePair "linkal-${name}" {
            description = "Linkal - ${name}";
            wantedBy = [ "multi-user.target" ];
            serviceConfig = {
              Type = "simple";
              ExecStart = "${cfg.package}/bin/linkal --port ${builtins.toString port} --calendar-file ${
                jsonFormat.generate "linkal-${name}.json" { inherit calendars; }
              }";
            };
          }
        )
        cfg.calendarGroups;

    # Configure bind for DNS certificate validation on *.cal.dgnum.eu.
    # services.bind = {
    #   enable = true;
    #   ipv4Only = true;
    #   extraConfig = ''
    #     include "${config.age.secrets."named-bind_dnskeys_conf".path}";
    #   '';
    #
    #   zones = [rec {
    #     name = "cal.dgnum.eu";
    #     file = "/var/db/bind/${name}";
    #     master = true;
    #     extraConfig = ''
    #       allow-update { key "rfc2136key.cal.dgnum.eu"; };
    #     '';
    #   }];
    # };
    #
    # networking.firewall = {
    #   allowedTCPPorts = [ 53 ];
    #   allowedUDPPorts = [ 53 ];
    # };
    #
    # age-secrets.options = [{ named-bind_dnskeys_conf.owner = "named"; }];
    #
    # # Configure ACME for DNS certificate validation
    # security.acme = {
    #   acceptTerms = true;
    #   defaults = {
    #     dnsProvider = "rfc2136";
    #     credentialsFile = config.age.secrets."acme-certs_secret".path;
    #     dnsPropagationCheck = false;
    #   };
    # };

    services.nginx = {
      enable = true;

      virtualHosts =
        mapAttrs'
          (
            name:
            { port, ... }:
            nameValuePair "${name}.${cfg.domain}" {
              enableACME = true;
              # acmeRoot = null; # Use DNS-01 validation
              forceSSL = true;

              locations."/".proxyPass = "http://127.0.0.1:${builtins.toString port}/";
            }
          )
          cfg.calendarGroups;
    };
  };
}