{ config, ... }:

let
  # TODO: mkVHost
in
{
  imports = [
    ../../services/nginx.nix
    ../../services/prometheus-nginx.nix
  ];

  services.nginx.virtualHosts = {
    "mta-sts.${config.networking.domain}" = {
      quic = true;
      kTLS = true;
      forceSSL = true;
      enableACME = true;
      extraConfig = ''
        add_header Strict-Transport-Security max-age=15768000;
      '';
      locations."= /.well-known/mta-sts.txt" = {
        alias = "/srv/http/mta-sts.txt";
        extraConfig = ''
          default_type text/plain;
        '';
      };
    };
    "www.${config.networking.domain}" = {
      default = true;
      serverAliases = [ config.networking.domain ];
      quic = true;
      kTLS = true;
      forceSSL = true;
      enableACME = true;
      extraConfig = ''
        # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
        add_header Strict-Transport-Security max-age=15768000;
      '';
      locations = {
        "/" = {
          root = "/srv/http/www";
          index = "index.html";
          tryFiles = "$uri $uri/ $uri.html =404";
        };
        "/twentyyears/".alias = "/srv/http/twentyyears/";
        "/thirtytwoyears/".alias = "/srv/http/thirtytwoyears/";
        # RFC8805
        "/noc/".alias = "/srv/http/noc/";
        "/static/".alias = "/srv/http/static/";
        # RFC8805 new location
        "/.well-known/loc/".alias = "/srv/http/noc/";
        "= /.well-known/security.txt" = {
          alias = "/srv/http/security.txt";
          extraConfig = ''
            default_type text/plain;
          '';
        };
        "/.well-known/matrix/client" = {
          return = "200 '{\"m.homeserver\":{\"base_url\":\"https://matrix.berlin.ccc.de\"}}'";
          extraConfig = ''
            add_header Access-Control-Allow-Origin "*";
            default_type application/json;
          '';
        };
        "/.well-known/matrix/server" = {
          return = "200 '{\"m.server\":\"matrix.berlin.ccc.de:443\"}'";
          extraConfig = ''
            add_header Access-Control-Allow-Origin "*";
            default_type application/json;
          '';
        };
        "~ ^/~(.+?)" = {
          root = "/srv/http/homes";
          index = "index.html";
          tryFiles = "$uri $uri/ $uri.html =404";
          extraConfig = ''
            autoindex on;
          '';
        };
        "/all.ics" = {
          return = "301 https://$host/calendars/all.ics";
        };
        "~ ^/calendars/([^/]+\.ics)$" = {
          alias = "/srv/http/calendars/$1";
          extraConfig = ''
            add_header Cache-Control "no-cache";
            types {
              text/calendar ics;
            }
            default_type text/calendar;
          '';
        };
      };
    };
    "staging.${config.networking.domain}" = {
      quic = true;
      kTLS = true;
      forceSSL = true;
      enableACME = true;
      locations = {
        "/" = {
          basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
          root = "/srv/http/www-staging";
          index = "index.html";
          tryFiles = "$uri $uri/ $uri.html =404";
        };
        "/all.ics" = {
          return = "301 https://$host/calendars/all.ics";
        };
        "~ ^/calendars/([^/]+\.ics)$" = {
          alias = "/srv/http/calendars/$1";
          extraConfig = ''
            add_header Cache-Control "no-cache";
            types {
              text/calendar ics;
            }
            default_type text/calendar;
          '';
        };
      };
    };
  };
}