{ config, pkgs, ... }:

let
  xmppWebVersion = "0.12.0";

  xmppWebArchive = pkgs.fetchurl {
    url = "https://github.com/nioc/xmpp-web/releases/download/${xmppWebVersion}/xmpp-web-${xmppWebVersion}.tar.gz";
    hash = "sha256-IL9MLf75yP7gqMaV6vzYVXlGqWwIlbdmEK5wH831Ybc=";
  };

  xmppWebConfig = pkgs.writeText "xmpp-web-local.js" ''
    // eslint-disable-next-line no-unused-vars, no-var
    var config = {
      name: '0ff.space public chat',
      transports: {
        websocket: 'wss://chat.${config.domain}/xmpp-websocket',
      },
      hasGuestAccess: true,
      hasRegisteredAccess: false,
      anonymousHost: 'anon.${config.domain}',
      isTransportsUserAllowed: false,
      hasHttpAutoDiscovery: false,
      resource: '0ff.space Web Chat',
      defaultDomain: '${config.domain}',
      defaultMuc: 'muc.${config.domain}',
      isStylingDisabled: false,
      hasSendingEnterKey: true,
      connectTimeout: 5000,
      pinnedMucs: [
        'lobby@muc.${config.domain}',
      ],
      logoUrl: "",
      sso: {
        endpoint: false,
        jidHeader: 'jid',
        passwordHeader: 'password',
      },
      guestDescription: '<p>Öffentlicher Chat auf 0ff.space. Wähle einen Nicknamen und schreibe ohne Account mit.</p>',
    }
  '';

  xmppWeb = pkgs.runCommand "xmpp-web-${xmppWebVersion}" {
    nativeBuildInputs = [
      pkgs.gnutar
      pkgs.gzip
    ];
  } ''
    mkdir -p "$out"
    tar -xzf ${xmppWebArchive} --strip-components=1 -C "$out"
    cp ${xmppWebConfig} "$out/local.js"

    substituteInPlace "$out/index.html" \
      --replace-fail '<head>' '<head><script>if (!window.location.hash) window.location.replace("/#/guest?join=lobby%40muc.${config.domain}");</script>'
  '';
in
{
  networking.firewall.allowedTCPPorts = [ 8443 ];

  users.users.nginx.extraGroups = [ "prosody" ];

  systemd.tmpfiles.rules = [
    "z /var/lib/prosody/certs/${config.domain}.key.pem 0640 prosody prosody -"
  ];

  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;

    virtualHosts."chat.${config.domain}" = {
      onlySSL = true;
      listen = [
        {
          addr = config.tailnetIPs.pinix;
          port = 8443;
          ssl = true;
        }
      ];
      sslCertificate = "/var/lib/prosody/certs/${config.domain}.crt.pem";
      sslCertificateKey = "/var/lib/prosody/certs/${config.domain}.key.pem";
      root = xmppWeb;

      locations."/" = {
        tryFiles = "$uri $uri/ /index.html";
      };

      locations."/xmpp-websocket" = {
        proxyPass = "http://127.0.0.1:5280/xmpp-websocket";
        proxyWebsockets = true;
        extraConfig = ''
          proxy_read_timeout 900s;
        '';
      };
    };
  };

  services.prosody.virtualHosts."anon.${config.domain}" = {
    enabled = true;
    domain = "anon.${config.domain}";
    extraConfig = ''
      authentication = "anonymous"
      allow_anonymous_s2s = false

      modules_enabled = {
        "websocket";
      }

      modules_disabled = {
        "bookmarks";
        "cloud_notify";
        "mam";
        "pep";
        "private";
        "proxy65";
        "register";
        "roster";
        "vcard_legacy";
      }

      http_host = "chat.${config.domain}"
      http_external_url = "https://chat.${config.domain}/"
      http_paths = {
        websocket = "/xmpp-websocket";
      }
      cross_domain_websocket = { "https://chat.${config.domain}"; }
    '';
    ssl = {
      cert = "/var/lib/prosody/certs/${config.domain}.crt.pem";
      key = "/var/lib/prosody/certs/${config.domain}.key.pem";
    };
  };
}