{ config, depot, lib, pkgs, tools, ... }:

let
  inherit (tools.meta) domain;
  inherit (tools.nginx) vhosts;
  cfg = config.services.ipfs-cluster;
  ipfsCfg = config.services.ipfs;

  apiSocket = "/run/ipfs-cluster/ipfs-cluster-api.sock";
  pinSvcSocket = "/run/ipfs-cluster/ipfs-pinning-service-api.sock";
  proxySocket = "/run/ipfs-cluster/ipfs-api-proxy.sock";
in {
  imports = [
    depot.nixosModules.ipfs-cluster
  ];

  age.secrets = {
    ipfs-cluster-secret.file = ./cluster-secret.age;
    ipfs-cluster-pinsvc-credentials = {
      file = ./cluster-pinsvc-credentials.age;
      owner = cfg.user;
    };
  };

  services.ipfs-cluster = {
    enable = true;
    package = depot.packages.ipfs-cluster;
    consensus = "crdt";
    dataDir = "/srv/storage/ipfs/cluster";
    secretFile = config.age.secrets.ipfs-cluster-secret.path;
    pinSvcBasicAuthFile = config.age.secrets.ipfs-cluster-pinsvc-credentials.path;
    openSwarmPort = true;
    settings = {
      cluster = {
        peer_addresses = [
          "/ip4/95.216.8.12/tcp/9096/p2p/12D3KooWFqccQN24XbpJbguWmtqAJwKarPXxMNqGCz1wSQqKL97D"
          "/ip4/152.67.79.222/tcp/9096/p2p/12D3KooWC7y9GH5j6zioqGx6354WfWwKCQAKbRMDJY2gJ5j5qLzm"
        ];
        replication_factor_min = 1;
        replication_factor_max = 2;
      };
      api = {
        ipfsproxy = {
          listen_multiaddress = "/unix${proxySocket}";
          node_multiaddress = ipfsCfg.apiAddress;
        };
        pinsvcapi.http_listen_multiaddress = "/unix${pinSvcSocket}";
        restapi.http_listen_multiaddress = "/unix${apiSocket}";
      };
      ipfs_connector.ipfshttp.node_multiaddress = ipfsCfg.apiAddress;
    };
  };

  systemd.services.ipfs-cluster = {
    postStart = ''
      chmod 0660 ${apiSocket} ${pinSvcSocket} ${proxySocket}
    '';
    serviceConfig = {
      IPAddressDeny = [
        "10.0.0.0/8"
        "100.64.0.0/10"
        "169.254.0.0/16"
        "172.16.0.0/12"
        "192.0.0.0/24"
        "192.0.2.0/24"
        "192.168.0.0/16"
        "198.18.0.0/15"
        "198.51.100.0/24"
        "203.0.113.0/24"
        "240.0.0.0/4"
        "100::/64"
        "2001:2::/48"
        "2001:db8::/32"
        "fc00::/7"
        "fe80::/10"
      ];
    };
  };

  services.nginx.virtualHosts."pin.${domain}" = vhosts.proxy "http://unix:${pinSvcSocket}";
  users.users.nginx.extraGroups = [ cfg.group ];
  security.acme.certs."pin.${domain}" = {
    dnsProvider = "pdns";
    webroot = lib.mkForce null;
  };
}