{ config, pkgs, lib, ... }:

{
  systemd.services.gotosocial = {
    after = [ "tailscaled-autoconnect.service" ];
    wants = [ "tailscaled-autoconnect.service" ];
    unitConfig.StartLimitIntervalSec = 0;
    serviceConfig.RestartSec = "10s";
  };

  services.gotosocial = {
    enable = true;
    setupPostgresqlDB = true;
    # Load the OIDC client secret at runtime without putting it in the Nix store.
    environmentFile = config.age.secrets.oidcGTSEnv.path;
    settings = {
      application-name = "My GoToSocial";
      host = "social.${config.domain}";
      protocol = "https";
      bind-address = config.tailnetIPs.pinix;
      port = 8020;
      account-domain = "${config.domain}";
      oidc-enabled = "true";
      oidc-idp-name = "dex";
      oidc-issuer = "https://dex.${config.domain}/dex";
      oidc-client-id = "gotosocial";
      oidc-allowed-groups = [ "gotosocial" ];
      oidc-admin-groups = [ "gotosocial_admin" ];
      scopes = [
        "openid"
        "email"
        "profile"
        "groups"
        "admin"
      ];

      landing-page-user = "admin";
    };
  };
}