{ config, lib, pkgs, homeyConfig, ... }:

let
  cfg     = config.homey.stirlingPdf;
  dataDir = config.homey.storage.mountPoint;
  domain  = homeyConfig.domain;
in
{
  options.homey.stirlingPdf = {
    enable = lib.mkEnableOption "Stirling-PDF document tools";

    image = lib.mkOption {
      type    = lib.types.str;
      default = "stirlingtools/stirling-pdf:latest";
    };

    port = lib.mkOption {
      type    = lib.types.port;
      default = 8084;
      description = "Host port Stirling-PDF listens on (bound to 127.0.0.1).";
    };
  };

  config = lib.mkIf cfg.enable {
    # -----------------------------------------------------------------------
    # Container
    # -----------------------------------------------------------------------
    virtualisation.oci-containers.containers.stirling-pdf = {
      image = cfg.image;
      ports = [ "127.0.0.1:${toString cfg.port}:8080" ];

      environment = {
        # Disable Stirling-PDF's own login page — Authelia handles auth
        DOCKER_ENABLE_SECURITY           = "false";
        INSTALL_BOOK_AND_ADVANCED_HTML_OPS = "false";
        LANGS                            = "en_GB";
        TZ                               = homeyConfig.timezone;
      };

      volumes = [
        "${dataDir}/stirling-pdf/configs:/configs"
        "${dataDir}/stirling-pdf/customFiles:/customFiles"
      ];

      extraOptions = [ "--network=homey" ];
    };

    systemd.services."podman-stirling-pdf" = {
      after    = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
      requires = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
    };

    # -----------------------------------------------------------------------
    # Caddy virtual host — forward_auth to Authelia
    # -----------------------------------------------------------------------
    homey.caddy.virtualHosts = [{
      subdomain = "pdf";
      port      = cfg.port;
      auth      = true;
    }];

    # -----------------------------------------------------------------------
    # Authelia access control — one_factor for any authenticated user
    # -----------------------------------------------------------------------
    homey.authelia.accessControlRules = [{
      priority = 56;
      domain   = [ "pdf.${domain}" ];
      policy   = "one_factor";
    }];

    # -----------------------------------------------------------------------
    # Storage directories
    # -----------------------------------------------------------------------
    homey.storage.extraDirs = [
      { path = "stirling-pdf"; }
      { path = "stirling-pdf/configs";     mode = "0755"; }
      { path = "stirling-pdf/customFiles"; mode = "0755"; }
    ];

    # -----------------------------------------------------------------------
    # Backup
    # -----------------------------------------------------------------------
    homey.backup.extraPaths = [ "${dataDir}/stirling-pdf/configs" ];

    # -----------------------------------------------------------------------
    # Uptime Kuma monitor
    # -----------------------------------------------------------------------
    homey.monitoring.monitors = [{
      name     = "Stirling-PDF";
      url      = "https://pdf.${domain}";
      interval = 60;
    }];
  };
}