{ config, pkgs, ... }:

{
systemd.services.launcher = {
  description = "Main public website and landing page (0ff.space)";
  wantedBy = [ "multi-user.target" ];
  before = [ "traefik.service" ];
  serviceConfig = {
    User = "drone";
    Group = "users";
    ExecStart = "${pkgs.static-web-server}/bin/static-web-server --host 127.0.0.1 --port 8001 --root /var/www/launcher";
    Restart = "always";
    RestartSec = "5s";
  };
};

services.traefik.dynamicConfigOptions.http = {

  services.launcher.loadBalancer.servers = [
    {
      url = "http://127.0.0.1:8001/";
    }
    ];

  services.launcher-auth.loadBalancer.servers = [
    {
      url = "http://127.0.0.1:4180/";
    }
  ];

  middlewares = {
    gts-wf = {
      redirectRegex = {
        permanent = true;
          regex = "https://${config.domain}/.well-known/webfinger(\\?.*)?$";
          replacement = "https://social.${config.domain}/.well-known/webfinger$1";
      };
    };
    gts-ni = {
      redirectRegex = {
        permanent = true;
          regex = "https://${config.domain}/.well-known/nodeinfo(\\?.*)?$";
          replacement = "https://social.${config.domain}/.well-known/nodeinfo$1";
      };
    };
    gts-hm = {
      redirectRegex = {
        permanent = true;
          regex = "https://${config.domain}/.well-known/host-meta(\\?.*)?$";
          replacement = "https://social.${config.domain}/.well-known/host-meta$1";
      };
    };
  };
  routers.launcher-federation = {
    rule = "Host(`${config.domain}`) && (Path(`/.well-known/webfinger`) || Path(`/.well-known/nodeinfo`) || Path(`/.well-known/host-meta`))";
    priority = 100;
    tls = {
      certResolver = "cloudflare";
      };
    service = "launcher";
    middlewares = [ "gts-wf" "gts-ni" "gts-hm" ];
    entrypoints = [ "websecure" ];
  };

  routers.launcher = {
    rule = "Host(`${config.domain}`)";
    priority = 1;
    tls = {
      certResolver = "cloudflare";
      };
    # OAuth-Schutz für 0ff.space deaktiviert (29.07.2026). Zum
    # Reaktivieren: "launcher" gegen "launcher-auth" tauschen -- der
    # oauth2-proxy-Service bleibt unten deklariert und läuft weiter.
    service = "launcher";
    entrypoints = [ "websecure" ];
  };
};
}