{ config, lib, pkgs, ... }:

with config.krebs.lib;
let
  cfg = config.krebs.retiolum-bootstrap;

  out = {
    options.krebs.retiolum-bootstrap = api;
    config = lib.mkIf cfg.enable imp;
  };

  api = {
    enable = mkEnableOption "retiolum boot strap for tinc.krebsco.de";
    hostname = mkOption {
        type = types.str;
        description = "hostname which serves tinc boot";
        default = "tinc.krebsco.de" ;
    };
    listen = mkOption {
        type = with types; listOf str;
        description = ''Addresses to listen on (nginx-syntax).
        ssl will be configured, http will be redirected to ssl.
        Make sure to have at least 1 ssl port configured.
        '';
        default = [ "80" "443 ssl" ] ;
    };
    ssl_certificate_key = mkOption {
        type = types.str;
        description = "Certificate key to use for ssl";
        default = "${toString <secrets>}/tinc.krebsco.de.key";
    };
    ssl_certificate = mkOption {
        type = types.str;
        description = "Certificate file to use for ssl";
        default = "${toString <secrets>}/tinc.krebsco.de.crt" ;
    };
    # in use:
    #  <secrets/tinc.krebsco.de.crt>
    #  <secrets/tinc.krebsco.de.key>
  };

  imp = {
    krebs.nginx.servers = assert config.krebs.nginx.enable; {
      retiolum-boot-ssl = {
        server-names = singleton cfg.hostname;
        listen = cfg.listen;
        extraConfig = ''
          ssl_certificate ${cfg.ssl_certificate};
          ssl_certificate_key ${cfg.ssl_certificate_key};

          if ($scheme = http){
            return 301 https://$server_name$request_uri;
          }

          root ${pkgs.retiolum-bootstrap};
          try_files $uri $uri/retiolum.sh;
        '';
        locations = [];
      };
    };
  };

in
out