{ pkgs, ... }:

{
  systemd.tmpfiles.rules = [
    "d /opt/bjj-booker 0755 joe users"
  ];

  systemd.sockets.bjj-booker = {
    wantedBy = [ "sockets.target" ];
    socketConfig = {
      ListenStream = "/run/bjj-booker/socket";
      SocketGroup = "nginx";
      SocketMode = "0660";
    };
  };

  systemd.services.bjj-booker = {
    environment.GYMDESK_EMAIL = "nyc@mou.fo";
    serviceConfig = {
      Type = "exec";
      DynamicUser = true;
      WorkingDirectory = "/opt/bjj-booker";
      StateDirectory = "bjj-booker";
      LoadCredential = [ "GYMDESK_PASSWORD:/var/secrets/bjj-booker.password" ];
    };
    script = ''
      export GYMDESK_PASSWORD=$(< $CREDENTIALS_DIRECTORY/GYMDESK_PASSWORD)
      exec ${pkgs.nodejs-slim_24}/bin/node server.js
    '';
  };

  services.nginx.virtualHosts."bjj.mou.fo" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://unix:/run/bjj-booker/socket";
    };
    locations."=/bookings.ics" = {
      proxyPass = "http://unix:/run/bjj-booker/socket";
      extraConfig = ''
        auth_request off;
      '';
    };
  };

  services.oauth2-proxy.nginx.virtualHosts."bjj.mou.fo" = { };
}