{ pkgs, config, ... }:

{
  age.secrets = {
    nextcloud_db_pass = {
      file = ../../../secrets/nextcloud/nextcloud_db_pass.age;
      owner = "nextcloud";
      group = "nextcloud";
    };
    nextcloud_admin_pass = {
      file = ../../../secrets/nextcloud/nextcloud_admin_pass.age;
      owner = "nextcloud";
      group = "nextcloud";
    };
  };

  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud33;

    configureRedis = true;
    hostName = "nextcloud.crans.org";
    https = false;

    maxUploadSize = "4G";

    config = {
      dbtype = "pgsql";
      dbhost = "tealc.adm.crans.org";
      dbuser = "nextcloud";
      dbpassFile = config.age.secrets.nextcloud_db_pass.path;
      adminpassFile = config.age.secrets.nextcloud_admin_pass.path;
    };

    phpOptions = {
      "opcache.interned_strings_buffer" = "32";
      "opcache.memory_consumption" = "512";
    };

    settings = {
      trusted_proxies = [
        # hodaur
        "172.16.10.145"
      ];

      mail_domain = "crans.org";
      mail_from_address = "root";
      mail_smtphost = "smtp.crans.org";
      mail_smtpport = 25;
    };

    appstoreEnable = true;
    extraAppsEnable = true;
  };

  # Activation CORS pour récuppérer les agendas depuis le wiki
  # On est obligé de répéter les headers communs de sécurité car ils ne sont pas au même niveau
  # https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
  services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."~* /remote.php/dav/public-calendars/[a-z]+\?export".extraConfig =
    let
      base_headers = ''
        add_header X-Content-Type-Options nosniff;
        add_header X-Robots-Tag noindex, nofollow;
        add_header X-Permitted-Cross-Domain-Policies none;
        add_header X-Frame-Options sameorigin;
        add_header Referrer-Policy no-referrer;
        add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always;
        add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
      '';
    in
    ''
      ${base_headers}
      if ($request_method = 'OPTIONS') {
        ${base_headers}
        add_header 'Access-Control-Max-Age' 86400;
        add_header 'Content-Type' 'text/plain; charset=utf-8';
        add_header 'Content-Length' 0;
        return 204;
      }
    '';
}