{ config, pkgs, lib, ... }:

{
  sops.secrets."bitcoin/lnd-rpc-password" = {
    owner = "lnd";
    group = "lnd";
    mode = "0400";
  };

  users.groups.lnd = { };

  users.users.lnd = {
    isSystemUser = true;
    group = "lnd";
    extraGroups = [ "tor" ];
  };

  sops.templates."lnd.conf" = {
    owner = "lnd";
    group = "lnd";
    mode = "0400";
    content = ''
      [Application Options]
      debuglevel=info
      datadir=/var/lib/lnd
      logdir=/var/lib/lnd/logs

      alias=TobServer
      color=#3399ff

      listen=127.0.0.1:9735
      rpclisten=127.0.0.1:10009
      restlisten=127.0.0.1:8080

      tlsextraip=127.0.0.1
      tlsextradomain=localhost

      [Bitcoin]
      bitcoin.active=true
      bitcoin.mainnet=true
      bitcoin.node=bitcoind

      [Bitcoind]
      bitcoind.rpchost=127.0.0.1:8332
      bitcoind.rpcuser=lnd
      bitcoind.rpcpass=${config.sops.placeholder."bitcoin/lnd-rpc-password"}
      bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332
      bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333
      bitcoind.estimatemode=ECONOMICAL

      [tor]
      tor.active=true
      tor.socks=127.0.0.1:9050
      tor.control=127.0.0.1:9051
      tor.v3=true
      tor.streamisolation=true
      tor.targetipaddress=127.0.0.1
    '';
  };

  systemd.tmpfiles.rules = [
    "d /var/lib/lnd 0700 lnd lnd - -"
  ];

  systemd.services.lnd = {
    description = "Lightning Network Daemon";
    after = [
      "network-online.target"
      "tor.service"
      "bitcoind-mainnet.service"
    ];
    wants = [
      "network-online.target"
      "tor.service"
      "bitcoind-mainnet.service"
    ];
    wantedBy = [ "multi-user.target" ];

    serviceConfig = {
      User = "lnd";
      Group = "lnd";
      Type = "simple";

      ExecStart = "${pkgs.lnd}/bin/lnd --configfile=${config.sops.templates."lnd.conf".path}";

      Restart = "on-failure";
      RestartSec = "10s";

      StateDirectory = "lnd";
      StateDirectoryMode = "0700";

      NoNewPrivileges = true;
      PrivateTmp = true;
      ProtectSystem = "strict";
      ProtectHome = true;
      ReadWritePaths = [ "/var/lib/lnd" ];
    };
  };

  environment.systemPackages = [
    pkgs.lnd
  ];
}