{ config, ... }:

{
  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [
    5001
    5002
  ];

  services.nginx.virtualHosts."cal.${config.domain}" = {
    listen = [
      {
        addr = config.tailnetIPs.pinix;
        port = 5001;
      }
    ];
    # Kept up to date by the gitpull-calendar-web webhook, not this flake --
    # see hosts/pinix/localServices/webhook.nix. Source lives in the
    # separate calendar-web Forgejo repo.
    root = "/var/www/calendar-web/dist";

    extraConfig = ''
      add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'" always;
      add_header Referrer-Policy "no-referrer" always;
      add_header X-Content-Type-Options "nosniff" always;
    '';

    locations."/" = {
      tryFiles = "$uri $uri/ /index.html";
    };

    locations."= /calendar.ics" = {
      proxyPass = "http://${config.tailnetIPs.pinix}:5002/calendar/public/";
      extraConfig = ''
        limit_except GET HEAD {
          deny all;
        }
        proxy_set_header Authorization "";
        proxy_set_header Cookie "";
        proxy_hide_header Set-Cookie;
      '';
    };

    # lukas's personal calendar, exposed read-only. See the matching
    # Radicale rights rule (91-lukas-calendar-public) for the UUID and its
    # caveat.
    locations."= /lukas.ics" = {
      proxyPass = "http://${config.tailnetIPs.pinix}:5002/lukas/C6327392-6961-4753-A333-97ACE0A7CC82/";
      extraConfig = ''
        limit_except GET HEAD {
          deny all;
        }
        proxy_set_header Authorization "";
        proxy_set_header Cookie "";
        proxy_hide_header Set-Cookie;
      '';
    };
  };
}