{ pkgs, ... }:

let
  # Build Phanpy from its pinned source and keep the web root in the Nix store.
  phanpy = pkgs.callPackage ./phanpy/package.nix { };
in
{
  systemd.services."phanpy" = {
    wantedBy = [ "multi-user.target" ];
    description = "Phanpy Fediverse client web application";
    serviceConfig = {
      ExecStart = "${pkgs.static-web-server}/bin/static-web-server --host 0.0.0.0 --port 8004 --root ${phanpy}";
      Restart = "always";
      DynamicUser = true;
      NoNewPrivileges = true;
      PrivateTmp = true;
      ProtectHome = true;
      ProtectSystem = "strict";
    };
  };
}