{ config, pkgs, ... }:
let
  clientSecretFile = "/run/oauth2-proxy-secret/client-secret";
in
{
  services.oauth2-proxy = {
    enable = true;
    oidcIssuerUrl = "https://dex.${config.domain}/dex";
    httpAddress = "127.0.0.1:4180";
    clientID = "oauth2-proxy";
    clientSecretFile = clientSecretFile;
    reverseProxy = true;
    trustedProxyIP = [ "127.0.0.1/32" ];
    cookie.secretFile = config.age.secrets.oauth2Cookie.path;
    cookie.secure = true;
    email.domains = [ "*" ];
    provider = "oidc";
    upstream = [ "http://${config.tailnetIPs.pinix}:8001/" ];
    redirectURL = "https://${config.domain}/oauth2/callback";
  };

  systemd.services.oauth2-proxy-secret = {
    description = "Prepare oauth2-proxy client secret";
    before = [ "oauth2-proxy.service" ];
    restartTriggers = [ config.age.secrets.oidcOauth2.file ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      RuntimeDirectory = "oauth2-proxy-secret";
      RuntimeDirectoryMode = "0700";
    };
    script = ''
      umask 077
      ${pkgs.coreutils}/bin/tr -d '\r\n' \
        < ${config.age.secrets.oidcOauth2.path} \
        > ${clientSecretFile}
    '';
  };

  systemd.services.oauth2-proxy = {
    after = [ "dex.service" "traefik.service" ];
    requires = [ "oauth2-proxy-secret.service" ];
    wants = [ "dex.service" "traefik.service" ];
    restartTriggers = [
      config.age.secrets.oauth2Cookie.file
      config.age.secrets.oidcOauth2.file
    ];
    serviceConfig.RestartSec = "5s";
  };
}