{config, lib, ...}:

with import <stockholm/lib>;
let
  sec = toString <secrets>;
  ssl_cert = "${sec}/wildcard.krebsco.de.crt";
  ssl_key  = "${sec}/wildcard.krebsco.de.key";
in {
  # mattermost docker config and deployment guide: git.euer.krebsco.de
  virtualisation.docker.enable = true;
  users.extraUsers.${config.krebs.build.user.name}.extraGroups = [ "docker" ];
  krebs.nginx = {
    enable = true;
    servers.mattermost = {
      listen = [ "80" "443 ssl" ];
      server-names = [ "mattermost.euer.krebsco.de" ];
      extraConfig = ''
        gzip on;
        gzip_buffers 4 32k;
        gzip_types  text/plain application/x-javascript text/css;
        ssl_certificate ${ssl_cert};
        ssl_certificate_key ${ssl_key};
        default_type text/plain;

        if ($scheme = http){
          return 301 https://$server_name$request_uri;
        }

        client_max_body_size 4G;
        keepalive_timeout 10;

      '';
      locations = [
        (nameValuePair "/" ''
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header   Host $host;
          proxy_set_header   X-Real-IP          $remote_addr;
          proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_redirect      off;
          proxy_pass http://localhost:8065/;
        '')
      ];
    };
  };
}