{ nix-packages, system, config, pkgs, lib, ... }:
let
  matrix-media-repo = nix-packages.packages.${system}.matrix-media-repo;
  config-yml = pkgs.writeText "matrix-media-repo.yaml" (lib.generators.toYAML { } {
    repo = {
      bindAddress = "127.0.0.1";
      port = 8008;
      logDirectory = "-";
    };
    database.postgres = "postgresql:///matrix_media_repo?sslmode=disable&host=/run/postgresql";
    homeservers = [{
      name = "matrix.chir.rs";
      csApi = "https://matrix.chir.rs";
    }];
    admins = [ "@lotte:chir.rs" ];
    datastores = [{
      type = "s3";
      enabled = true;
      forKinds = [ "all" ];
      opts = {
        tempPath = "/tmp/mediarepo_s3_upload";
        endpoint = "s3.us-west-000.backblazeb2.com";
        accessKeyId = "#ACCESS_KEY_ID#";
        accessSecret = "#SECRET_ACCESS_KEY#";
        ssl = true;
        bucketName = "matrix-chir-rs";
        region = "us-west-000";
      };
    }];
    metrics = {
      enabled = true;
      bindAddress = "::";
      port = 9000;
    };
    urlPreviews = {
      enabled = true;
      numWorkers = 10;
      oEmbed = true;
      disallowedNetworks = [
        "127.0.0.1/8"
        "10.0.0.0/8"
        "172.16.0.0/12"
        "192.168.0.0/16"
        "::1/128"
        "fe80::/64"
        "fc00::/7"
      ];
    };
    downloads = {
      expireAfterDays = 7;
    };
    featureSupport = {
      MSC2448.enabled = true;
      MSC2246 = {
        enabled = true;
        asyncUploadExpirySecs = 120;
      };
    };
    sentry = {
      enable = true;
      dsn = "https://18e36e6f16b5490c83364101717cddba@o253952.ingest.sentry.io/6449283";
    };
  });
in
{
  networking.firewall.interfaces."wg0".allowedTCPPorts = [ 9000 ];
  systemd.services.matrix-media-repo = {
    description = "Matrix Media Repo";
    after = [ "network.target" ];
    wantedBy = [ "multi-user.target" ];
    path = [ matrix-media-repo ];
    preStart = ''
      akid=$(cat ${config.sops.secrets."services/matrix-media-repo/access-key-id".path})
      sak=$(cat ${config.sops.secrets."services/matrix-media-repo/secret-access-key".path})
      cat ${config-yml} > /var/lib/matrix-media-repo/config.yml
      sed -i "s|#ACCESS_KEY_ID#|$akid|g" /var/lib/matrix-media-repo/config.yml
      sed -i "s|#SECRET_ACCESS_KEY#|$sak|g" /var/lib/matrix-media-repo/config.yml
    '';
    serviceConfig = {
      Type = "simple";
      User = "matrix-media-repo";
      Group = "matrix-media-repo";
      Restart = "always";
      ExecStart = "${matrix-media-repo}/bin/media_repo -config /var/lib/matrix-media-repo/config.yml";
    };
  };
  sops.secrets."services/matrix-media-repo/access-key-id".owner = "matrix-media-repo";
  sops.secrets."services/matrix-media-repo/secret-access-key".owner = "matrix-media-repo";
  users.users.matrix-media-repo = {
    description = "Matrix Media Repository";
    home = "/var/lib/matrix-media-repo";
    useDefaultShell = true;
    group = "matrix-media-repo";
    isSystemUser = true;
  };
  users.groups.matrix-media-repo = { };
  systemd.tmpfiles.rules = [
    "d '/var/lib/matrix-media-repo' 0750 matrix-media-repo matrix-media-repo - -"
  ];
  services.postgresql.ensureDatabases = [
    "matrix_media_repo"
  ];
  services.postgresql.ensureUsers = [{
    name = "matrix-media-repo";
    ensurePermissions = {
      "DATABASE matrix_media_repo" = "ALL PRIVILEGES";
    };
  }];
  services.nginx.virtualHosts."matrix.chir.rs" = {
    sslCertificate = "/var/lib/acme/chir.rs/cert.pem";
    sslCertificateKey = "/var/lib/acme/chir.rs/key.pem";
    locations."/_matrix" = {
      proxyPass = "https://matrix.int.chir.rs";
      proxyWebsockets = true;
      extraConfig = ''
        proxy_ssl_server_name on;
        proxy_hide_header Access-Control-Allow-Origin;
        add_header Access-Control-Allow-Origin '*' always;
      '';
    };
    locations."/_matrix/media" = {
      proxyPass = "http://localhost:8008";
      proxyWebsockets = true;
      extraConfig = ''
        proxy_hide_header Access-Control-Allow-Origin;
        add_header Access-Control-Allow-Origin '*' always;
      '';
    };
    locations."/.well-known/matrix/server" = {
      extraConfig = ''
        return 200 '{ "m.server": "matrix.chir.rs:443" }';
      '';
    };
    locations."/.well-known/matrix/client" = {
      extraConfig = ''
        add_header Access-Control-Allow-Origin '*';
        return 200 '{ "m.homeserver": { "base_url": "https://matrix.chir.rs" } }';
      '';
    };
    locations."/_synapse/metrics" = {
      extraConfig = ''
        return 404 'Not found';
      '';
    };
  };
  services.nginx.virtualHosts."chir.rs" = {
    locations."/.well-known/matrix/server" = {
      extraConfig = ''
        return 200 '{ "m.server": "matrix.chir.rs:443" }';
      '';
    };
    locations."/.well-known/matrix/client" = {
      extraConfig = ''
        add_header Access-Control-Allow-Origin '*';
        return 200 '{ "m.homeserver": { "base_url": "https://matrix.chir.rs" } }';
      '';
    };
  };
}