infrastructure/machines/web01/wordpress/module.nix

{ config, lib, pkgs, ... }:

let
  inherit (lib) mkEnableOption mkIf mkOption;
  inherit (lib.types) anything attrsOf port;

  inherit (config.security.acme) certs;

  cfg = config.services.wp-containers;

  mkName = builtins.replaceStrings [ "." ] [ "-" ];
  mkIp = ip: i: "${ip}.${builtins.toString i}";

  mkConfig = { name, value, i }: {
    services.wordpress = {
      webserver = "nginx";
      sites.${name} = value;
    };

    services.nginx.virtualHosts.${name} = {
      onlySSL = true;
      sslCertificate = "${certs.${name}.directory}/fullchain.pem";
      sslCertificateKey = "${certs.${name}.directory}/key.pem";
      sslTrustedCertificate = "${certs.${name}.directory}/chain.pem";
    };

    networking = {
      hostName = mkName name;
      hosts.${mkIp "10.0.0" i} = [ name ];

      firewall.allowedTCPPorts = [ 443 ];
    };

    environment.systemPackages = [ pkgs.wp-cli ];

    system.stateVersion = "23.11";
  };

  mkContainer = i: site: {
    name = mkName site.name;

    value = {
      privateNetwork = true;

      forwardPorts = [{
        containerPort = 443;
        hostPort = cfg.basePort + i;
      }];

      bindMounts.certs = {
        hostPath = certs.${site.name}.directory;
        mountPoint = certs.${site.name}.directory;
      };

      hostAddress = mkIp "10.31.41" i;
      localAddress = mkIp "10.0.0" i;

      autoStart = true;

      config = mkConfig (site // { inherit i; });
    };
  };

  mkVhost = i: site: {
    inherit (site) name;
    value = {
      enableACME = true;
      forceSSL = true;

      locations."/".proxyPass =
        "https://${mkIp "10.31.41" i}:${builtins.toString (cfg.basePort + i)}";
    };
  };

  siteList = lib.attrsToList cfg.sites;
in {
  options.services.wp-containers = {
    enable = mkEnableOption "wordpress sites in containers";

    basePort = mkOption {
      type = port;
      default = 9090;
    };

    sites = mkOption {
      type = attrsOf anything;
      default = { };
    };
  };

  config = mkIf cfg.enable {
    containers = builtins.listToAttrs (lib.imap0 mkContainer siteList);

    services.nginx.virtualHosts =
      builtins.listToAttrs (lib.imap0 mkVhost siteList);
  };
}