{ config, pkgs, modulesPath, lib, system, ... }:

{
  config = {
    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
    sops.defaultSopsFile = ../../secrets/s3.yaml;
    sops.secrets."garage/rpc-secret" = {
      owner = "garage";
      mode = "0400";
    };
    sops.secrets."garage/admin-token" = {
      owner = "garage";
      mode = "0400";
    };
    sops.secrets."garage/env" = { };

    networking.hostName = "s3";
    networking.firewall.allowedTCPPorts = [ 3900 3902 ];

    users.users.garage = {
      isSystemUser = true;
      group = "garage";
    };
    users.groups.garage = { };

    systemd.services.garage = {
      serviceConfig = {
        DynamicUser = false;
        User = "garage";
        Group = "garage";
      };
      unitConfig.RequiresMountsFor = "/mnt/data";
    };

    services.garage = {
      enable = true;
      package = pkgs.garage;
      environmentFile = config.sops.secrets."garage/env".path;
      settings = {
        data_dir = "/mnt/data";
        replication_factor = 1;
        rpc_bind_addr = "[::]:3901";
        rpc_secret_file = config.sops.secrets."garage/rpc-secret".path;
        s3_api = {
          s3_region = "garage";
          api_bind_addr = "[::]:3900";
        };
        s3_web = {
          bind_addr = "[::]:3902";
          root_domain = ".s3web.kumardamani.net";
          index = "index.html";
        };
        admin = {
          api_bind_addr = "127.0.0.1:3901";
          admin_token_file = config.sops.secrets."garage/admin-token".path;
        };
      };
    };

    fileSystems = {
      "/mnt/data" = {
        device = "nas.bacala:/mnt/tank/customers/lab/s3";
        fsType = "nfs";
      };
    };
  };
}