{ config, pkgs, checker, ... }:

let
  checkerPkg = checker.packages.${pkgs.stdenv.hostPlatform.system}.default;
in
{
  users.users.checker = {
    isSystemUser = true;
    group = "checker";
    home = "/var/lib/checker";
    createHome = true;
  };

  users.groups.checker = {};

  sops.secrets."checker/env" = {
    owner = "checker";
    group = "checker";
    mode = "0400";
  };

  systemd.services.checker = {
    description = "Checker a personal assistant";
    wantedBy = [ "multi-user.target" ];
    after = [ "network.target" ];

    serviceConfig = {
      User = "checker";
      Group = "checker";
      WorkingDirectory = "/var/lib/checker";
      ExecStart = "${checkerPkg}/bin/checker";
      EnvironmentFile = config.sops.secrets."checker/env".path;

      Restart = "always";
      RestartSec = 5;

      NowNewPrivileges = true;
      PrivateTmp = true;
      ProtectSystem = "strict";
      ProtectHome = true;
      ReadWritePaths = [ "/var/lib/checker" ];
    };
  };

  services.nginx.virtualHosts."checker.tobiasostner.de" = {
    enableACME = true;
    forceSSL = true;

    locations."/" = {
      proxyPass = "http://127.0.0.1:3001";
    };
  };
}