{ pkgs, config, lib, ... }:
with lib;
let
  user = "miniflux";
  host = "rss.dtth.ch";
  port = 10020;

  secrets = config.sops.secrets;

  configEnv = builtins.mapAttrs (name: value: toString value) {
    DEBUG = "on";
    DATABASE_URL = "user=${user} dbname=${user} sslmode=disable host=/run/postgresql";
    RUN_MIGRATIONS = 1;
    LISTEN_ADDR = "127.0.0.1:${toString port}";
    BASE_URL = "https://${host}";
    HTTPS = true;

    OAUTH2_PROVIDER = "oidc";
    OAUTH2_CLIENT_ID = "oYF8Y815kQNuuYYdACJmm3kD1hzniMe6fJIDRUfs";
    OAUTH2_REDIRECT_URL = "https://${host}/oauth2/oidc/callback";
    OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.dtth.ch/application/o/rss/";
    OAUTH2_USER_CREATION = 1;

    LOG_DATE_TIME = true;

    FETCH_YOUTUBE_WATCH_TIME = true;
  };

  package = pkgs.miniflux;
in
{
  sops.secrets."miniflux/oidc-client-secret" = { };
  sops.secrets."miniflux/pocket-consumer-key" = { };
  sops.secrets."miniflux/admin-creds" = { };

  cloud.postgresql.databases = [ user ];

  cloud.traefik.hosts.miniflux = {
    inherit port host;
  };

  systemd.services.miniflux = {
    description = "Miniflux service";
    wantedBy = [ "multi-user.target" ];
    after = [ "network.target" ];
    requires = [ "postgresql.service" ];

    serviceConfig = {
      ExecStart = "${package}/bin/miniflux";
      User = user;
      DynamicUser = true;
      RuntimeDirectory = "miniflux";
      RuntimeDirectoryMode = "0700";
      EnvironmentFile = [
        secrets."miniflux/admin-creds".path
        secrets."miniflux/oidc-client-secret".path
        secrets."miniflux/pocket-consumer-key".path
      ];
      # Hardening
      CapabilityBoundingSet = [ "" ];
      DeviceAllow = [ "" ];
      LockPersonality = true;
      MemoryDenyWriteExecute = true;
      PrivateDevices = true;
      PrivateUsers = true;
      ProcSubset = "pid";
      ProtectClock = true;
      ProtectControlGroups = true;
      ProtectHome = true;
      ProtectHostname = true;
      ProtectKernelLogs = true;
      ProtectKernelModules = true;
      ProtectKernelTunables = true;
      ProtectProc = "invisible";
      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
      RestrictNamespaces = true;
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      SystemCallArchitectures = "native";
      SystemCallFilter = [ "@system-service" "~@privileged" ];
      UMask = "0077";
    };

    environment = configEnv;
  };
}