{ config, lib, pkgs, ... }:
let
  inherit (lib)
    concatStringsSep
    mapAttrsToList
    mkEnableOption
    mkIf
    mkOption
    optionalAttrs
    optionalString
    types;

  cfg = config.services.wafrn;

  toEnvString = value:
    if builtins.isBool value then
      (if value then "true" else "false")
    else if builtins.isInt value || builtins.isFloat value then
      toString value
    else
      value;

  quoteEnv = value:
    let
      s = toEnvString value;
      escaped = lib.replaceStrings [ "\\" "\"" "\n" "\r" ] [ "\\\\" "\\\"" "\\n" "" ] s;
    in
    "\"${escaped}\"";

  baseEnv = {
    ADMIN_USER = "admin";
    ADMIN_EMAIL = "admin@example.com";
    ADMIN_PASSWORD = "change-me";

    JWT_SECRET = "change-me";

    DOMAIN_NAME = "wafrn.example.com";
    CACHE_DOMAIN = "cache.wafrn.example.com";
    MEDIA_DOMAIN = "media.wafrn.example.com";
    FRONTEND_MEDIA_URL = "https://media.wafrn.example.com";
    FRONTEND_CACHE_URL = "https://cache.wafrn.example.com/api/cache?media=";
    FRONTEND_FQDN_URL = "https://wafrn.example.com";

    FRONTEND_SHORT_TITLE = "Wafrn";
    FRONTEND_LONG_TITLE = "Wafrn, the social media that respects you";
    FRONTEND_DESCRIPTION = "Wafrn is a federated social media inspired by tumblr that connects with the fediverse and bluesky";

    DONATION_URL = "https://wafrn.example.com/about";

    REGISTRATION_LEVEL = "PUBLIC";
    REGISTRATIONS_DISABLED_TEXT = "This instance is a private instance, and does not allow registrations";
    REVIEW_REGISTRATIONS = true;
    REGISTRATION_MINIMUM_AGE = 18;
    BUBBLE_SERVERS_SHOW_TYPE = "PUBLIC";
    BLOCKED_SERVERS_SHOW_TYPE = "LOGGEDIN";
    AUTOFOLLOW_MAIN_ADMIN = true;

    DISABLE_REQUIRE_SEND_EMAIL = false;
    SMTP_HOST = "smtp.example.com";
    SMTP_USER = "wafrn";
    SMTP_PORT = 587;
    SMTP_PASSWORD = "change-me";
    SMTP_FROM = "wafrn@example.com";

    POSTGRES_USER = "root";
    POSTGRES_PASSWORD = "root";
    POSTGRES_DBNAME = "wafrn";
    POSTGRES_DB = "wafrn";

    ACME_EMAIL = "admin@example.com";

    WEBPUSH_EMAIL = "mailto:info@wafrn.net";
    WEBPUSH_PRIVATE = "";
    WEBPUSH_PUBLIC = "";

    ENABLE_BSKY = cfg.bluesky.enable;
    PDS_DOMAIN_NAME = cfg.bluesky.pdsDomain;
    PDS_JWT_SECRET = "change-me";
    PDS_ADMIN_PASSWORD = "change-me";
    PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX = "";

    ENABLE_RAW_OUTPUT = false;
    LOG_SQL_QUERIES = "";
    UPLOAD_LIMIT = "";
    POSTS_PER_PAGE = "";
    LOG_LEVEL = "";
    BLOCKLIST_URI = "";
    FRONTEND_PATH = "";
    BLOCKED_IPS = "";
    IGNORE_BLOCK_HOSTS = "";
    FRONTEND_LOGO = "";
    FRONTEND_API_URL = "";
    FRONTEND_CACHE_BACKUP_URLS = "";
    FRONTEND_SHORTEN_POSTS = "3";
    FRONTEND_DISABLE_PWA = false;
    FRONTEND_MAINTENANCE = false;
  };

  effectiveEnv = baseEnv // cfg.environment;

  envFileContents =
    concatStringsSep "\n" (mapAttrsToList (name: value: "${name}=${quoteEnv value}") effectiveEnv) + "\n";

  envTemplate = pkgs.writeText "wafrn.env.base" envFileContents;

  serviceEnvFile = "${cfg.stateDir}/.env";
  composeFile = "${cfg.stateDir}/docker-compose.yml";
  sourcePath = cfg.source;

  publishedPorts =
    lib.optionals (cfg.httpPort != null) [ "${toString cfg.httpPort}:80" ]
    ++ lib.optionals (cfg.httpsPort != null) [ "${toString cfg.httpsPort}:443" ];

  firewallPorts =
    lib.optionals (cfg.httpPort != null) [ cfg.httpPort ]
    ++ lib.optionals (cfg.httpsPort != null) [ cfg.httpsPort ];

  serviceCommon = {
    restart = "unless-stopped";
    env_file = [ serviceEnvFile ];
  };

  backendBuild = {
    context = sourcePath;
    dockerfile = "packages/backend/Dockerfile";
  };

  backendService = {
    build = backendBuild;
    depends_on = {
      db = { condition = "service_started"; };
      redis = { condition = "service_started"; };
      frontend = { condition = "service_started"; };
      migration = { condition = "service_completed_successfully"; };
    };
    environment = {
      NODE_ENV = "production";
      USE_WORKERS = "true";
    };
    volumes = [
      "${cfg.stateDir}/uploads:/app/packages/backend/uploads"
      "${cfg.stateDir}/cache:/app/packages/backend/cache"
      "${cfg.stateDir}/frontend:/app/packages/frontend:ro"
    ];
  };

  composeConfig = {
    services = {
      backend = serviceCommon // backendService;

      migration = serviceCommon // backendService // {
        restart = "no";
        depends_on = {
          db = { condition = "service_started"; };
          redis = { condition = "service_started"; };
          frontend = { condition = "service_started"; };
        };
        command = "npm exec tsx migrate.ts init-container";
      };

      frontend = serviceCommon // {
        build = {
          context = sourcePath;
          dockerfile = "packages/frontend/Dockerfile";
        };
        restart = "unless-stopped";
        ports = publishedPorts;
        extra_hosts = [ "host.docker.internal:host-gateway" ];
        volumes = [
          "${cfg.stateDir}/caddy:/data"
          "${cfg.stateDir}/frontend:/var/www/html/frontend"
          "${cfg.stateDir}/uploads:/var/www/html/uploads"
          "${sourcePath}/packages/caddy:/etc/caddy/config"
        ];
      };

      db = {
        image = "postgres:17";
        restart = "unless-stopped";
        shm_size = "2gb";
        env_file = [ serviceEnvFile ];
        environment = {
          POSTGRES_DB = "${effectiveEnv.POSTGRES_DBNAME}";
        };
        volumes = [ "${cfg.stateDir}/postgres:/var/lib/postgresql/data" ];
      };

      redis = {
        image = "redis:7.2.4";
        restart = "unless-stopped";
        volumes = [ "${cfg.stateDir}/redis:/data" ];
      };
    }
    // optionalAttrs cfg.adminer.enable {
      adminer = {
        image = "adminer";
        restart = "unless-stopped";
      };
    }
    // optionalAttrs cfg.bluesky.enable {
      pds_worker = serviceCommon // {
        build = backendBuild;
        command = "npm exec tsx atproto.ts";
        depends_on = {
          db = { condition = "service_started"; };
          redis = { condition = "service_started"; };
          migration = { condition = "service_completed_successfully"; };
        };
        environment = {
          NODE_ENV = "production";
          USE_WORKERS = "true";
        };
        volumes = [
          "${cfg.stateDir}/uploads:/app/packages/backend/uploads"
          "${cfg.stateDir}/cache:/app/packages/backend/cache"
          "${cfg.stateDir}/frontend:/app/packages/frontend:ro"
        ];
      };
    }
    // optionalAttrs (cfg.bluesky.enable && cfg.bluesky.useBundledPds) {
      pds = {
        image = "ghcr.io/bluesky-social/pds:0.4";
        restart = "unless-stopped";
        env_file = [ serviceEnvFile ];
        environment = {
          PDS_DATA_DIRECTORY = "/pds";
          PDS_BLOBSTORE_DISK_LOCATION = "/pds/blocks";
          PDS_BLOB_UPLOAD_LIMIT = "157286400";
          PDS_DID_PLC_URL = "https://plc.directory";
          PDS_BSKY_APP_VIEW_URL = "https://api.bsky.app";
          PDS_BSKY_APP_VIEW_DID = "did:web:api.bsky.app";
          PDS_REPORT_SERVICE_URL = "https://mod.bsky.app";
          PDS_REPORT_SERVICE_DID = "did:plc:ar7c4by46qjdydhdevvrndac";
          PDS_CRAWLERS = "https://bsky.network, https://atproto.africa";
          PDS_EMAIL_SMTP_URL = "smtps://${effectiveEnv.SMTP_USER}:${effectiveEnv.SMTP_PASSWORD}@${toString effectiveEnv.SMTP_HOST}:${toString effectiveEnv.SMTP_PORT}";
          PDS_EMAIL_FROM_ADDRESS = "${effectiveEnv.SMTP_FROM}";
          LOG_ENABLED = "true";
        };
        volumes = [ "${cfg.stateDir}/pds:/pds" ];
      };
    };

    networks = {
      default = {
        enable_ipv6 = true;
      };
    };
  };

  composeTemplate = pkgs.writeText "wafrn-compose.yml" (lib.generators.toYAML { } composeConfig);

  composeCmd = "${pkgs.docker-compose}/bin/docker-compose";
in
{
  options.services.wafrn = {
    enable = mkEnableOption "Wafrn social platform";

    source = mkOption {
      type = types.str;
      example = "/srv/wafrn";
      description = "Path to a Wafrn source checkout (used as Docker build context).";
    };

    stateDir = mkOption {
      type = types.path;
      default = "/var/lib/wafrn";
      description = "Persistent state directory for databases, uploads, caddy data, and optional PDS data.";
    };

    composeProjectName = mkOption {
      type = types.str;
      default = "wafrn";
      description = "Docker Compose project name.";
    };

    secretsFile = mkOption {
      type = types.nullOr types.path;
      default = null;
      example = "/run/secrets/wafrn.env";
      description = "Optional dotenv file with secret overrides appended at runtime.";
    };

    environment = mkOption {
      type = types.attrsOf (types.oneOf [ types.str types.int types.float types.bool ]);
      default = { };
      description = "Non-secret environment overrides written to the generated .env file.";
    };

    httpPort = mkOption {
      type = types.nullOr types.port;
      default = 80;
      description = "Host port mapped to Wafrn HTTP (container port 80). Set to null to disable publishing HTTP.";
    };

    httpsPort = mkOption {
      type = types.nullOr types.port;
      default = 443;
      description = "Host port mapped to Wafrn HTTPS (container port 443). Set to null to disable publishing HTTPS.";
    };

    autoBuild = mkOption {
      type = types.bool;
      default = true;
      description = "Whether to pass --build when starting containers.";
    };

    openFirewall = mkOption {
      type = types.bool;
      default = true;
      description = "Open configured HTTP/HTTPS ports in the NixOS firewall.";
    };

    adminer.enable = mkOption {
      type = types.bool;
      default = false;
      description = "Enable Adminer container.";
    };

    bluesky = {
      enable = mkOption {
        type = types.bool;
        default = false;
        description = "Enable Bluesky integration and ATProto worker.";
      };

      useBundledPds = mkOption {
        type = types.bool;
        default = false;
        description = "Run Wafrn's bundled Bluesky PDS container. Set false to use an external PDS.";
      };

      pdsDomain = mkOption {
        type = types.str;
        default = "bsky.example.com";
        description = "PDS domain used by Wafrn (can point to an external PDS).";
      };
    };
  };

  config = mkIf cfg.enable {
    assertions = [
      {
        assertion = config.virtualisation.docker.enable;
        message = "services.wafrn requires virtualisation.docker.enable = true;";
      }
      {
        assertion = cfg.httpPort != null || cfg.httpsPort != null;
        message = "services.wafrn requires at least one published port (httpPort or httpsPort).";
      }
    ];

    systemd.tmpfiles.rules = [
      "d ${cfg.stateDir} 0750 root root -"
      "d ${cfg.stateDir}/postgres 0750 root root -"
      "d ${cfg.stateDir}/redis 0750 root root -"
      "d ${cfg.stateDir}/uploads 0750 root root -"
      "d ${cfg.stateDir}/cache 0750 root root -"
      "d ${cfg.stateDir}/caddy 0750 root root -"
      "d ${cfg.stateDir}/frontend 0750 root root -"
    ] ++ lib.optionals (cfg.bluesky.enable && cfg.bluesky.useBundledPds) [
      "d ${cfg.stateDir}/pds 0750 root root -"
    ];

    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall firewallPorts;

    systemd.services.wafrn-prepare = {
      description = "Prepare Wafrn runtime files";
      wantedBy = [ "multi-user.target" ];
      before = [ "wafrn.service" ];
      after = [ "docker.service" ];
      path = [ pkgs.nodejs pkgs.coreutils ];
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
      };
      script = ''
        set -euo pipefail

        if [ ! -d "${cfg.source}" ]; then
          echo "wafrn-nix: source directory does not exist: ${cfg.source}" >&2
          exit 1
        fi

        if [ ! -f "${cfg.source}/package-lock.json" ]; then
          echo "wafrn-nix: package-lock.json missing, generating with npm" >&2
          if ! (cd "${cfg.source}" && npm install --package-lock-only --ignore-scripts); then
            echo "wafrn-nix: failed to generate package-lock.json, continuing with existing source" >&2
          fi
        fi

        install -m 0600 ${envTemplate} ${serviceEnvFile}
        ${optionalString (cfg.secretsFile != null) ''
          if [ ! -f "${cfg.secretsFile}" ]; then
            echo "wafrn-nix: secretsFile does not exist: ${cfg.secretsFile}" >&2
            exit 1
          fi
          cat "${cfg.secretsFile}" >> ${serviceEnvFile}
        ''}
        install -m 0644 ${composeTemplate} ${composeFile}
      '';
    };

    systemd.services.wafrn = {
      description = "Wafrn Docker Compose stack";
      wantedBy = [ "multi-user.target" ];
      requires = [ "docker.service" "wafrn-prepare.service" ];
      after = [ "docker.service" "wafrn-prepare.service" ];
      path = [ pkgs.docker-compose pkgs.coreutils ];

      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
        WorkingDirectory = cfg.stateDir;
      };

      script = ''
        ${composeCmd} --project-name ${cfg.composeProjectName} --file ${composeFile} up -d ${optionalString cfg.autoBuild "--build"}
      '';

      preStop = ''
        ${composeCmd} --project-name ${cfg.composeProjectName} --file ${composeFile} down
      '';

      reload = ''
        ${composeCmd} --project-name ${cfg.composeProjectName} --file ${composeFile} up -d ${optionalString cfg.autoBuild "--build"}
      '';
    };
  };
}