{ config, pkgs, lib, ... }:

{
  sops.secrets."nextcloud/mail-json" = {
    sopsFile = ../secrets/nextcloud-mail.json;
    format = "json";
    key = "";
    owner = "root";
    group = "root";
    mode = "0400";
  };

  sops.secrets."nextcloud/admin-pass" = {
    owner = "root";
    group = "root";
    mode = "0400";
  };

  services = {

    nextcloud = {
      enable = true;
      hostName = "cloud.tobiasostner.de";
      https = true;

      database.createLocally = true;
      configureRedis = true;

      config = {
        dbtype = "mysql";
        adminuser = "tobi";
	      adminpassFile = config.sops.secrets."nextcloud/admin-pass".path;
      };

      autoUpdateApps.enable = true;
      datadir = "/nextcloud-data";

      settings = {
        default_phone_region = "DE";
        log_type = "file";
        logfile = "/var/log/nextcloud/nextcloud.log";
        maintenance_window_start = 2;

        overwritewebroot = "";
	      overwrite.cli.url = "https://cloud.tobiasostner.de";
	      overwritehost = "cloud.tobiasostner.de";
	      overwriteprotocol = "https";

        ## Email settings
        mail_smtpmode = "smtp";
        mail_smtphost = "smtp.protonmail.ch";
        mail_smtpport = 587;
        mail_smtpauth = true;
        mail_from_address = "tobias";
        mail_domain = "ostner.name";

        enabledPreviewProviders = [
          "OC\\Preview\\PNG"
          "OC\\Preview\\JPEG"
          "OC\\Preview\\GIF"
          "OC\\Preview\\Movie"
        ];

        preview_ffmpeg_path = "${pkgs.ffmpeg}/bin/ffmpeg";
        preview_ffprobe_path = "${pkgs.ffmpeg}/bin/ffprobe";
      };

      phpOptions = lib.mkForce {
        "memory_limit" = "4096M";
        "upload_max_filesize" = "20G";
        "post_max_size" = "20G";
        "date.timezone" = "Europe/Berlin";
        "output_buffering" = "Off";
        "opcache.enable" = "1";
        "opcache.enable_cli" = "1";
        "opcache.memory_consumption" = "512";
        "opcache.interned_strings_buffer" = "64";
        "opcache.save_comments" = "1";
        "opcache.max_accelerated_files" = "30000";
      };

      secretFile = config.sops.secrets."nextcloud/mail-json".path;
    };

    restic.backups.nextcloud = {
      initialize = true;
      repository = "b2:tobcloud-backup:nextcloud";
      passwordFile = "/var/lib/nextcloud/restic-password";
      environmentFile = "/var/lib/nextcloud/backblaze-env";
      paths = [
        "/nextcloud-data"
        "/var/backup/nextcloud"
      ];
      backupPrepareCommand = ''
        set -euo pipefail
        install -d -m 0750 -o root -g root /var/backup/nextcloud
        ${pkgs.mariadb}/bin/mysqldump --single-transaction --databases nextcloud \
          > /var/backup/nextcloud/nextcloud.sql
      '';
      timerConfig = {
        OnCalendar = "daily";
      };
      pruneOpts = [
        "--keep-daily 7"
        "--keep-weekly 4"
        "--keep-monthly 12"
      ];
    };

    nginx = {
      enable = true;
      virtualHosts."cloud.tobiasostner.de" = {
        forceSSL = true;
	      enableACME = true;
      };
    };

    cron.systemCronJobs = [
      "0 */6 * * * root nextcloud-occ preview:pre-generate"
    ];
  };

  environment.shellAliases = {
    occ = "sudo nextcloud-occ";
  };

  users.users.nextcloud.extraGroups = [ "podman" ];

  systemd.services.phpfpm-nextcloud.path = [ pkgs.ffmpeg ];

  systemd.tmpfiles.rules = [
    "d /var/log/nextcloud 0750 nextcloud nextcloud - -"
    "d /var/backup/nextcloud 0750 root root - -"
  ];
}