{ config, lib, pkgs, ... }:
let
  cfg = config.services.librespeed;
in {
  options.services.librespeed = let
    inherit (lib) mkOption types;
  in {
    enable = lib.mkEnableOption "LibreSpeed server";
    package = lib.mkPackageOption pkgs "librespeed-rust" {};
    configureNginx = mkOption {
      description = "Configure nginx as a reverse proxy for LibreSpeed.";
      default = if (cfg.domain != null) then true else false;
      type = types.bool;
    };
    contactEmail = mkOption {
      description = "Email address listed in the privacy policy.";
      default = if (cfg.domain != null) then "webmaster@${cfg.domain}" else "webmaster@${config.networking.fqdn}";
      type = types.str;
    };
    domain = mkOption {
      description = ''
        If not `null`, this will add an entry to `services.librespeed.servers` and
        configure an nginx reverse proxy at the specified FQDN, unless explicitly disabled.
      '';
      default = null;
      type = with types; nullOr nonEmptyStr;
    };
    openFirewall = mkOption {
      description = ''
        Whether to open the firewall for the specified port.
        This is only necessary if no reverse proxy is used.
      '';
      default = false;
      type = types.bool;
    };
    pageTitle = mkOption {
      description = "Title of the webpage.";
      default = "LibreSpeed";
      type = types.str;
    };
    secrets = mkOption {
      description = ''
        Attribute set of filesystem paths.
        The contents of the specified paths will be read at service start time and merged with the attributes provided in `settings`.
      '';
      default = {};
      type = with types; nullOr (attrsOf path);
    };
    servers = mkOption {
      description = "LibreSpeed servers that should apper in the server list.";
      type = types.listOf (types.submodule {
        options = let
          inherit (types) nonEmptyStr;
        in {
          name = mkOption {
            description = "Name shown in the server list.";
            type = nonEmptyStr;
          };
          server = mkOption {
            description = "URL to the server. You may use `//` instead of `http://` or `https://`.";
            type = nonEmptyStr;
          };
          dlURL = mkOption {
            description = ''
              URL path to download test on this server.
              Append `.php` to the default value if the server uses the php implementation.
            '';
            default = "backend/garbage";
            type = nonEmptyStr;
          };
          ulURL = mkOption {
            description = ''
              URL path to upload test on this server.
              Append `.php` to the default value if the server uses the php implementation.
            '';
            default = "backend/empty";
            type = nonEmptyStr;
          };
          pingURL = mkOption {
            description = ''
              URL path to latency/jitter test on this server.
              Append `.php` to the default value if the server uses the php implementation.
            '';
            default = "backend/empty";
            type = nonEmptyStr;
          };
          getIpURL = mkOption {
            description = ''
              URL path to IP lookup on this server.
              Append `.php` to the default value if the server uses the php implementation.
            '';
            default = "backend/getIP";
            type = nonEmptyStr;
          };
        };
      });
    };
    settings = mkOption {
      description = ''
        LibreSpeed configuration written as Nix expression.
        All values set to `null` will be excluded from the evaluated config.
        This is useful if you want to omit certain defaults when using a different LibreSpeed implementation.

        See [github.com/librespeed][librespeed] for configuration help.

        [librespeed]: https://github.com/librespeed/speedtest-rust
      '';
      default = {};
      type = with types; nullOr (attrsOf (oneOf [
        bool
        int
        str
        null
      ]));
    };
  };
  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = cfg.configureNginx -> cfg.domain != null;
        message = ''
          `services.librespeed.configureNginx` requires `services.librespeed.domain` to be set.
        '';
      }
    ];

    networking.firewall = lib.mkIf (cfg.openFirewall) {
      allowedTCPPorts = [ cfg.settings.listen_port ];
    };
    services.nginx.virtualHosts = lib.mkIf cfg.configureNginx {
      ${cfg.domain} = {
        locations."/" = {
          proxyPass = "http://${cfg.settings.bind_address}:${toString cfg.settings.listen_port}";
          recommendedProxySettings = true;
        };
        enableACME = true;
        forceSSL = true;
      };
    };
    security.acme.certs = lib.mkIf cfg.configureNginx {
      ${cfg.domain} = {};
    };

    services.librespeed.servers = lib.mkIf (cfg.domain != null) [
      {
        name = cfg.domain;
        server = "https://${cfg.domain}";
      }
    ];
    services.librespeed.settings = let
      inherit (lib) mkDefault mkIf;

      assets = pkgs.runCommand "librespeed-assets" {
        preferLocal = true;

        serverList = ''
          function get_servers() {
            return ${builtins.toJSON cfg.servers}
          }
        '';
      } ''
        cp -r ${pkgs.librespeed-rust}/assets $out
        cat >$out/server_list.js <<<"$serverList"
        substitute ${pkgs.librespeed-rust}/assets/index.html $out/index.html \
          --replace-fail "LibreSpeed Example" ${lib.escapeShellArg (lib.escapeXML cfg.pageTitle)} \
          --replace-fail "PUT@YOUR_EMAIL.HERE" ${lib.escapeShellArg (lib.escapeXML cfg.contactEmail)} \
          --replace-fail "TO BE FILLED BY DEVELOPER" ${lib.escapeShellArg (lib.escapeXML cfg.contactEmail)}
      '';
    in {
      speed_test_dir = assets;
      bind_address = mkDefault (if cfg.configureNginx then "127.0.0.1" else "0.0.0.0");
      listen_port = mkDefault 8989;
      base_url = mkDefault "backend";
      worker_threads = mkDefault "auto";

      database_type = mkDefault "none";
      database_file = mkIf (cfg.settings.database_type == "sqlite") mkDefault "/var/lib/librespeed/speedtest.sqlite";

      #librespeed-rust will fail to start if the following config parameters are omitted.
      ipinfo_api_key = mkIf (!cfg.secrets ? "ipinfo_api_key") "";
      stats_password = mkIf (!cfg.secrets ? "stats_password") "";
      tls_key_file = mkDefault "";
      tls_cet_file = mkDefault "";

      enable_tls = mkDefault false;
    };

    systemd.services = let
      configFile = let
        anyToString = arg: if (lib.isBool arg) then
          lib.boolToString arg
        else if (lib.isInt arg) then
          toString arg
        else "\"${lib.escape [ "\"" ] (toString arg)}\"";
      in
        with lib; pipe cfg.settings [
          (filterAttrs (_: val: val != null))
          (mapAttrs (name: val: "${path}=${anyToString val}"))
          (concatLines attrValues)
          (pkgs.writeText "${cfg.package.name}-config.toml")
      ];
    in {
      librespeed-secrets = lib.mkIf (cfg.secrets != {}) {
        description = "LibreSpeed secret helper";

        ExecStart = let
          script = pkgs.writeShellApplication {
            name = "librespeed-secrets";
            runtimeInputs = [ pkgs.coreutils ];
            text = ''
              cp ${configFile} ''${RUNTIME_DIRECTORY%%:*}/config.toml
            '' + lib.pipe cfg.secrets [
              (lib.mapAttrs (name: file: ''
                cat >>''${RUNTIME_DIRECTORY%%:*}/config.toml <<EOF
                ${name}="$(<${lib.escapeShellArg file})"
                EOF
              ''))
              (lib.concatLines lib.attrValues)
            ];
          };
        in lib.getExe script;

        serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = true;
          RuntimeDirectory = "librespeed";
          UMask = "u=rw";
        };
      };
      librespeed = {
        description = "LibreSpeed server daemon";
        wantedBy = [ "multi-user.target" ];
        wants = [ "network-online.target" ];
        requires = lib.optionals (cfg.secrets != {}) [ "librespeed-secrets.service" ];

        serviceConfig = {
          Type = "simple";
          Restart = "always";

          DynamicUser = true;

          ExecStartPre = lib.mkIf (!cfg.secrets ? "ipinfo_api_key") "${lib.getExe cfg.package} --update-ipdb";
          ExecStart = "${lib.getExe cfg.package} -c ${if (cfg.secrets == {}) then configFile else "\${RUNTIME_DIRECTORY%%:*}/config.toml"}";
          WorkingDirectory = "/var/cache/librespeed";
          RuntimeDirectory = "librespeed";
          RuntimeDirectoryPreserve = true;
          StateDirectory = "librespeed";
          CacheDirectory = "librespeed";
          SyslogIdentifier = "librespeed";

          ReadOnlyPaths = [ cfg.package ];
          RestrictSUIDSGID = true;
          RestrictNamespaces = true;
          PrivateTmp = true;
          PrivateDevices = true;
          PrivateUsers = true;
          ProtectHostname = true;
          ProtectClock = true;
          ProtectKernelTunables = true;
          ProtectKernelModules = true;
          ProtectKernelLogs = true;
          ProtectControlGroups = true;
          ProtectSystem = "strict";
          ProtectHome = true;
          ProtectProc = "invisible";
          SystemCallArchitectures = "native";
          SystemCallFilter = "@system-service";
          SystemCallErrorNumber = "EPERM";
          LockPersonality = true;
          NoNewPrivileges = true;
        };
      };
    };
  };

  meta.maintainers = with lib.maintainers; [ snaki ];
}