{ config, lib, pkgs, homeyConfig, ... }:

# Nextcloud + PostgreSQL.
#
# Two containers:
#   nextcloud-postgres  — PostgreSQL, bound to localhost:5432
#   nextcloud           — Nextcloud PHP-FPM + Apache, bound to localhost:8080
#
# Volume layout:
#   <dataDir>/nextcloud/db/    → /var/lib/postgresql/data  (postgres)
#   <dataDir>/nextcloud/html/  → /var/www/html              (nextcloud)
#
# Secrets consumed from sops:
#   nextcloud/admin_password
#   nextcloud/postgres_password

let
  cfg     = config.homey.nextcloud;
  dataDir = config.homey.storage.mountPoint;
  domain  = homeyConfig.domain;

  # Custom Nextcloud config mounted into the container as an extra config file.
  # Nextcloud auto-loads all *.config.php files in /var/www/html/config/.
  nextcloudCustomConfig = pkgs.writeText "zakobar.config.php" ''
    <?php
    $CONFIG = [
      // Throttle preview generation during bulk uploads.
      // Generating thumbnails re-reads every uploaded file and writes preview
      // files, roughly doubling disk I/O.  Limiting concurrency to 1 prevents
      // the drive from being hit by simultaneous read+write storms.
      'preview_concurrency_new' => 1,
      'preview_concurrency_all' => 1,
      // Cap preview dimensions to reduce per-preview write size.
      'preview_max_x' => 1024,
      'preview_max_y' => 1024,
      'jpeg_quality'  => 75,
    ];
  '';

  # Limit Apache's prefork MPM so at most 4 PHP processes write to the USB
  # drive simultaneously.  Default is often 150, which causes an I/O storm
  # on slow USB HDDs.  Lower = fewer concurrent writers = more stable I/O.
  apacheMpmConfig = pkgs.writeText "mpm_prefork.conf" ''
    <IfModule mpm_prefork_module>
        StartServers          2
        MinSpareServers       1
        MaxSpareServers       3
        MaxRequestWorkers     4
        MaxConnectionsPerChild 500
    </IfModule>
  '';
in
{
  options.homey.nextcloud = {
    enable = lib.mkEnableOption "Nextcloud file server" // { default = true; };

    image = lib.mkOption {
      type    = lib.types.str;
      default = "docker.io/nextcloud:latest";
    };

    postgresImage = lib.mkOption {
      type    = lib.types.str;
      default = "docker.io/postgres:16";
    };

    port = lib.mkOption {
      type    = lib.types.port;
      default = 8080;
      description = "Host port Nextcloud listens on (bound to 127.0.0.1).";
    };

    postgresPort = lib.mkOption {
      type    = lib.types.port;
      default = 5432;
      description = "Host port PostgreSQL listens on (bound to 127.0.0.1).";
    };
  };

  config = lib.mkIf cfg.enable {
    # -----------------------------------------------------------------------
    # Secrets
    # -----------------------------------------------------------------------
    sops.secrets."nextcloud/admin_password"    = { owner = "root"; };
    sops.secrets."nextcloud/postgres_password" = { owner = "root"; };

    # -----------------------------------------------------------------------
    # PostgreSQL container
    # -----------------------------------------------------------------------
    virtualisation.oci-containers.containers.nextcloud-postgres = {
      image = cfg.postgresImage;
      # Exposed on localhost for debugging; nextcloud reaches it via the
      # container name "nextcloud-postgres" on the homey network.
      ports = [ "127.0.0.1:${toString cfg.postgresPort}:5432" ];

      environment = {
        POSTGRES_DB   = "nextcloud_db";
        POSTGRES_USER = "postgres";
        # Password injected via env file
      };

      volumes = [
        "${dataDir}/nextcloud/db:/var/lib/postgresql/data"
      ];

      extraOptions = [
        "--network=homey"
        "--env-file=/run/nc-postgres-secrets.env"
      ];
    };

    systemd.services."podman-nextcloud-postgres" = {
      serviceConfig = {
        LoadCredential = [
          "nextcloud_postgres_password:${config.sops.secrets."nextcloud/postgres_password".path}"
        ];
        ExecStartPre = [
          (pkgs.writeShellScript "nc-postgres-secrets-env" ''
            set -euo pipefail
            install -m 600 /dev/null /run/nc-postgres-secrets.env
            echo "POSTGRES_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/nextcloud_postgres_password")" \
              >> /run/nc-postgres-secrets.env
          '')
        ];
      };
      postStop = "rm -f /run/nc-postgres-secrets.env";
      after    = lib.mkAfter  [ "mnt-data.mount" "podman-homey-network.service" ];
      requires = lib.mkAfter  [ "mnt-data.mount" "podman-homey-network.service" ];
    };

    # -----------------------------------------------------------------------
    # Nextcloud container
    # -----------------------------------------------------------------------
    virtualisation.oci-containers.containers.nextcloud = {
      image = cfg.image;
      # Apache inside the container listens on port 80; map it to cfg.port on
      # the host so Caddy can reach it. Postgres is reachable by container name.
      ports = [ "127.0.0.1:${toString cfg.port}:80" ];

      environment = {
        POSTGRES_HOST             = "nextcloud-postgres";
        POSTGRES_DB               = "nextcloud_db";
        POSTGRES_USER             = "postgres";
        NEXTCLOUD_ADMIN_USER      = "admin";
        NEXTCLOUD_TRUSTED_DOMAINS = "nextcloud.${domain}";
        OVERWRITEPROTOCOL         = "https";
        OVERWRITECLIURL           = "https://nextcloud.${domain}";
        OVERWRITEHOST             = "nextcloud.${domain}";
        # Trust the reverse proxy (Caddy on the host reaches the container
        # via the podman bridge; cover all RFC-1918 ranges to be robust).
        TRUSTED_PROXIES           = "10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.1 ::1";
        # Passwords injected via env file
      };

      volumes = [
        "${dataDir}/nextcloud/html:/var/www/html"
        # Extra config auto-loaded by Nextcloud (throttles preview generation)
        "${nextcloudCustomConfig}:/var/www/html/config/zakobar.config.php:ro"
        # Apache MPM limits (caps concurrent PHP processes / disk writers)
        "${apacheMpmConfig}:/etc/apache2/mods-available/mpm_prefork.conf:ro"
      ];

      extraOptions = [
        "--network=homey"
        "--env-file=/run/nc-secrets.env"
      ];
    };

    # -----------------------------------------------------------------------
    # Authelia access control — one_factor; Nextcloud manages its own login UI.
    # -----------------------------------------------------------------------
    homey.authelia.accessControlRules = [{
      priority = 55;
      domain   = [ "nextcloud.${domain}" ];
      policy   = "one_factor";
    }];

    # -----------------------------------------------------------------------
    # Caddy virtual host — no forward_auth; Nextcloud manages its own auth
    # -----------------------------------------------------------------------
    homey.caddy.virtualHosts = [{
      subdomain = "nextcloud";
      port      = cfg.port;
      auth      = false;
      extraConfig = ''
        redir /.well-known/carddav /remote.php/dav/ 301
        redir /.well-known/caldav  /remote.php/dav/ 301
        request_body {
          max_size 5GB
        }
        reverse_proxy localhost:${toString cfg.port} {
          header_up X-Forwarded-For {remote_host}
        }
      '';
      extraHttpConfig = ''
        redir /.well-known/carddav /remote.php/dav/ 301
        redir /.well-known/caldav  /remote.php/dav/ 301
        request_body {
          max_size 5GB
        }
        reverse_proxy localhost:${toString cfg.port} {
          header_up X-Forwarded-Proto https
          header_up X-Forwarded-For {remote_host}
        }
      '';
    }];

    # -----------------------------------------------------------------------
    # Storage directories
    # UID 33 = www-data in the Nextcloud container
    # UID 999 = postgres — must own the db dir (creates files directly in it)
    # -----------------------------------------------------------------------
    homey.storage.extraDirs = [
      { path = "nextcloud"; }
      { path = "nextcloud/html";    user = "33";  group = "33"; }
      { path = "nextcloud/db";      mode = "0700"; user = "999"; group = "999"; }
      { path = "nextcloud/db-dump"; mode = "0700"; }
    ];

    # -----------------------------------------------------------------------
    # Backup — exclude raw DB dir (pg_dump file in db-dump/ is used instead)
    # -----------------------------------------------------------------------
    homey.backup.extraPaths        = [ "${dataDir}/nextcloud" ];
    homey.backup.extraExcludePaths = [ "${dataDir}/nextcloud/db" ];

    # -----------------------------------------------------------------------
    # Uptime Kuma monitor for this service
    # -----------------------------------------------------------------------
    homey.monitoring.monitors = [{
      name       = "Nextcloud";
      url        = "https://nextcloud.${domain}/status.php";
      interval   = 60;
      keyword    = "\"maintenance\":false";
      # Nightly maintenance is expected — only alert if stuck for 4+ hours.
      # 240 retries × 60s = 4 hours of consecutive failures before notifying.
      maxretries = 240;
    }];

    systemd.services."podman-nextcloud" = {
      serviceConfig = {
        LoadCredential = [
          "nextcloud_postgres_password:${config.sops.secrets."nextcloud/postgres_password".path}"
          "nextcloud_admin_password:${config.sops.secrets."nextcloud/admin_password".path}"
        ];
        ExecStartPre = [
          (pkgs.writeShellScript "nc-secrets-env" ''
            set -euo pipefail
            install -m 600 /dev/null /run/nc-secrets.env
            echo "POSTGRES_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/nextcloud_postgres_password")"       >> /run/nc-secrets.env
            echo "NEXTCLOUD_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/nextcloud_admin_password")"   >> /run/nc-secrets.env
          '')
        ];
      };
      postStop = "rm -f /run/nc-secrets.env";
      after    = lib.mkAfter  [ "mnt-data.mount" "podman-nextcloud-postgres.service" "podman-homey-network.service" ];
      requires = lib.mkAfter  [ "mnt-data.mount" "podman-nextcloud-postgres.service" "podman-homey-network.service" ];
    };
  };
}