{ pkgs, ... }:

# Self-hosted draw.io/diagrams.net web client, Tailnet-only
# (schema.${domain}, routes-internal.nix). Reason: Mermaid (used for
# docs/pipelines.md) is text-only -- no mouse-driven drag-and-drop editing.
# draw.io's native file format is plain XML, so diagrams stay git-trackable
# and hand-editable in a terminal, same as every other text artifact in
# this repo, while also giving a real GUI for mouse+keyboard editing.
#
# This packages only the static webapp (src/main/webapp from upstream) --
# no Java/Tomcat, no Docker, served the same way as the dashboard repo
# (static-web-server). Diagrams are not stored by this service itself:
# open/save happens via the browser's "Device" storage (a local .drawio
# file), which then gets committed to docs/diagrams/ like any other file.
let
  webapp = pkgs.stdenvNoCC.mkDerivation {
    pname = "drawio-webapp";
    version = "30.2.6";
    src = pkgs.fetchFromGitHub {
      owner = "jgraph";
      repo = "drawio";
      rev = "1e87452174bd0f484212494a6166529c1ad75b80"; # v30.2.6
      hash = "sha256-TfaAvhLqa73kmQI4KpFnymjTW26SwQEseLSLQiQ3KGE=";
    };
    installPhase = ''
      mkdir -p $out
      cp -r src/main/webapp/. $out/
    '';
  };
in
{
  systemd.services.drawio = {
    description = "draw.io web client, tailnet-only (schema.0ff.space)";
    wantedBy = [ "multi-user.target" ];
    before = [ "traefik.service" ];
    serviceConfig = {
      User = "drone";
      Group = "users";
      ExecStart = "${pkgs.static-web-server}/bin/static-web-server --host 127.0.0.1 --port 8850 --root ${webapp}";
      Restart = "always";
      RestartSec = "5s";
    };
  };
}