# Nix configuration for deploying the Reciproka Kolektivo website
{
  self,
  config,
  pkgs,
  ...
}: let
  flake = builtins.getFlake (toString ../.);
  reciproka-web = flake.inputs.reciproka-web.packages."${pkgs.system}".default;
  webdomain = "reciproka.net";
in {
  environment.sessionVariables = {
    LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
  };

  services.nginx = {
    enable = true; # Enable Nginx
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    virtualHosts = {
      "${webdomain}" = {
        # website hostname
        enableACME = true; # Use ACME certs
        forceSSL = true; # Force SSL
        root = "${reciproka-web}"; # Wesbite root
      };
      "www.${webdomain}" = {
        # Respect our elders :-)
        locations."/".extraConfig = "return 301 $scheme://${webdomain}$request_uri;";
        enableACME = true; # Use ACME certs
        forceSSL = true; # Force SSL
      };
      "reciproka.co" = {
        locations."/".extraConfig = "return 301 $scheme://${webdomain}$request_uri;";
        enableACME = true; # Use ACME certs
        forceSSL = true; # Force SSL
      };
    };
  };

  security.acme = {
    acceptTerms = true;
    certs = {
      "${webdomain}" = {email = "admin@${webdomain}";};
      "www.${webdomain}" = {email = "admin@${webdomain}";};
      "reciproka.co" = {email = "admin@${webdomain}";};
    };
  };

  networking.firewall.allowedTCPPorts = [80 443];
}