{ config, lib, pkgs, ... }:
{
  users.groups.smbwebdav = { };

  users.users.smbwebdav = {
    isSystemUser = true;
    group = "smbwebdav";
    shell = "${pkgs.shadow}/bin/nologin";
  };

  users.users.webdav.extraGroups = [ "smbwebdav" ];

  systemd.tmpfiles.rules = [
    "d /var/www/webdav 0770 webdav smbwebdav - -"
  ];

  services.webdav = {
    enable = true;
    environmentFile = config.age.secrets.webdav.path;
    settings = {
      address = "0.0.0.0";
      port = 8012;
      scope = "/var/www/webdav";
      modify = true;
      auth = true;
      users = [
        {
          username = "{env}ENV_USERNAME";
          password = "{env}ENV_PASSWORD";
        }
      ];
      permissions = "RCUD";
      cors = {
        enabled = true;
        credentials = true;
	allowed_headers = [ "Depth" "Authorization" "Content-Type" "Overwrite" "Destination" ];
        allowed_hosts = [ "https://board.${config.domain}" ];
        allowed_methods = [ "GET" "PUT" "PROPFIND" "OPTIONS" "DELETE" ];
        exposed_headers = [ "Content-Length" "Content-Range" ];
      };
    };
  };

  services.samba = {
    enable = true;
    settings = {
      global = {
        "server string" = "pinix files";
        "server min protocol" = "SMB3";
        "smb ports" = 445;
        "map to guest" = "never";
      };
      webdav = {
        path = "/var/www/webdav";
        "valid users" = "smbwebdav";
        "read only" = "no";
        "guest ok" = "no";
        "force group" = "smbwebdav";
        "vfs objects" = "streams_xattr";
        "ea support" = "yes";
        "store dos attributes" = "yes";
        "create mask" = "0660";
        "directory mask" = "0770";
      };
    };
  };

  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 445 ];

  systemd.services.samba-smbd = {
    after = [ "tailscaled-autoconnect.service" ];
    wants = [ "tailscaled-autoconnect.service" ];
  };

  systemd.services.samba-webdav-password = {
    description = "Set the SMB password for the WebDAV share";
    before = [ "samba-smbd.service" ];
    requiredBy = [ "samba-smbd.service" ];
    restartTriggers = [ config.age.secrets.webdav.file ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
    script = ''
      set -eu
      password="$(${pkgs.gawk}/bin/awk -F= '$1 == "ENV_PASSWORD" { sub(/^[^=]*=/, ""); print; exit }' ${config.age.secrets.webdav.path})"
      if [ -z "$password" ]; then
        echo "ENV_PASSWORD is missing from the WebDAV secret" >&2
        exit 1
      fi
      printf '%s\n%s\n' "$password" "$password" | ${pkgs.samba}/bin/smbpasswd -a -s smbwebdav
    '';
  };
}