{ pkgs, lib, ... }:

with lib;
let
  name = "bgt_cyberwar_hidden_service";
  sec = (toString <secrets>) + "/";
  secdir = sec + name;
  srvdir = "/var/lib/tor/onion/";
  basedir = srvdir + name;
  hn = builtins.readFile (secdir + "/hostname");
in
{
  systemd.services.prepare-hidden-service = {
    wantedBy = [ "local-fs.target" ];
    before = [ "tor.service" ];
    serviceConfig = {
      ExecStart = pkgs.writeScript "prepare-euer-blog-service" ''
        #!/bin/sh
        set -euf
        if ! test -d "${basedir}" ;then
          mkdir -p "${srvdir}"
          cp -r "${secdir}" "${srvdir}"
          chown -R tor:tor "${srvdir}"
          chmod -R 700 "${basedir}"
        else
          echo "not overwriting ${basedir}"
        fi
      '';
      Type = "oneshot";
      RemainAfterExit = "yes";
      TimeoutSec = "0";
    };
  };
  services.nginx.virtualHosts."${hn}".locations."/" = {
    proxyPass = "https://blog.binaergewitter.de";
    extraConfig = ''
        proxy_set_header  Host blog.binaergewitter.de;
        proxy_ssl_server_name on;
    '';
  };
  services.tor = {
    enable = true;
    hiddenServices."${name}".map = [
     { port = "80"; }
     # { port = "443"; toHost = "blog.binaergewitter.de"; }
    ];
  };
}