{ pkgs, config, ... }:

{
  age.secrets = {
    nextcloud_db_pass = {
      file = ../../../secrets/nextcloud/nextcloud_db_pass.age;
      owner = "nextcloud";
      group = "nextcloud";
    };
    nextcloud_admin_pass = {
      file = ../../../secrets/nextcloud/nextcloud_admin_pass.age;
      owner = "nextcloud";
      group = "nextcloud";
    };
  };

  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud33;

    configureRedis = true;
    hostName = "nextcloud.crans.org";
    https = false;

    maxUploadSize = "4G";

    config = {
      dbtype = "pgsql";
      dbhost = "tealc.adm.crans.org";
      dbuser = "nextcloud";
      dbpassFile = config.age.secrets.nextcloud_db_pass.path;
      adminpassFile = config.age.secrets.nextcloud_admin_pass.path;
    };

    phpOptions = {
      "opcache.interned_strings_buffer" = "32";
      "opcache.memory_consumption" = "512";
    };

    settings = {
      trusted_proxies = [
        # hodaur
        "172.16.10.145"
      ];

      mail_domain = "crans.org";
      mail_from_address = "root";
      mail_smtphost = "smtp.crans.org";
      mail_smtpport = 25;
    };

    appstoreEnable = true;
    extraAppsEnable = true;
  };

  # Activation CORS pour récuppérer les agendas depuis le wiki
  # TODO: à mettre que sur /remote.php/dav/public-calendars/ pour éviter des requêtes malveillantes depuis le wiki.
  services.nginx.virtualHosts.${config.services.nextcloud.hostName}.extraConfig = ''
    add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always;
    add_header 'Access-Control-Allow-Methods' 'GET' always;
    add_header 'Access-Control-Allow-Credentials' 'false' always;
    add_header 'Vary' 'Origin' always;
  '';
}