{ config, pkgs, modulesPath, lib, system, ... }:

{
  config = {
    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
    sops.defaultSopsFile = ../../secrets/rproxy-2.yaml;
    sops.secrets."caddy/env" = {
      owner = "caddy";
      restartUnits = [ "caddy.service" ];
    };

    networking.hostName = "rproxy-2";
    networking.firewall.allowedTCPPorts = [ 80 443 2222 ];

    # caddy can't proxy raw SSH, so relay TCP :2222 to the git VM's sshd.
    # This is how git push works via git.kumardamani.net: clients use
    #   ssh://git@git.kumardamani.net:2222/<repo>.git
    # or a "Port 2222" entry for git.kumardamani.net in ~/.ssh/config.
    systemd.services.git-ssh-relay = {
      description = "Relay TCP :2222 to git:22 (SSH push via git.kumardamani.net)";
      wantedBy = [ "multi-user.target" ];
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      serviceConfig = {
        ExecStart = "${pkgs.socat}/bin/socat TCP-LISTEN:2222,fork,reuseaddr TCP:git:22";
        Restart = "always";
        RestartSec = 2;
      };
    };

    services.caddy = {
      enable = true;
      package = pkgs.caddy.withPlugins {
        plugins = [ "github.com/caddy-dns/namecheap@v1.0.0" ];
        hash = "sha256-G+iBYwqKNB0kyQ060R9J2brbwsRl/WgvB6Tkc6MC5yU=";
      };
      environmentFile = config.sops.secrets."caddy/env".path;

      # Test config only
      # virtualHosts."rproxy2.kumardamani.net:80".extraConfig = ''
      #   respond "Hello, world! {$NAMECHEAP_API_USER}"
      #   tls internal
      # '';

      virtualHosts."lidarr.kumardamani.net:443".extraConfig = ''
        reverse_proxy med-dl:8686
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."git.kumardamani.net:443".extraConfig = ''
        reverse_proxy git:80
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."radarr.kumardamani.net:443".extraConfig = ''
        reverse_proxy med-dl:7878
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."sonarr.kumardamani.net:443".extraConfig = ''
        reverse_proxy med-dl:8989
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."namemydragon.lol:443".extraConfig = ''
        reverse_proxy sites:84
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."www.namemydragon.lol:443".extraConfig = ''
        reverse_proxy sites:84
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."metrics2.kumardamani.net:443".extraConfig = ''
        reverse_proxy monitoring:9090
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."torrents.kumardamani.net:443".extraConfig = ''
        reverse_proxy torrents:9091
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."vault.kumardamani.net:443".extraConfig = ''
        reverse_proxy vault:8989
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."nc.kumardamani.net:443".extraConfig = ''
        reverse_proxy nc-kumar:11000
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."kumardamani.net:443".extraConfig = ''
        reverse_proxy sites:83
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."www.kumardamani.net:443".extraConfig = ''
        reverse_proxy sites:83
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."damanistuff.net:443".extraConfig = ''
        reverse_proxy sites:82
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."www.damanistuff.net:443".extraConfig = ''
        reverse_proxy sites:82
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."kavisjourneys.com".extraConfig = ''
        reverse_proxy sites:81
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."www.kavisjourneys.com".extraConfig = ''
        reverse_proxy sites:81
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';

      virtualHosts."*.min.kumardamani.net".extraConfig = ''
        reverse_proxy minio:9000
        tls {
          dns namecheap {
            api_key {$NAMECHEAP_API_KEY}
            user {$NAMECHEAP_API_USER}
          }
        }
      '';
    };
  };
}