{ pkgs, ... }:

{
  systemd.tmpfiles.rules = [
    "d /opt/cal 0755 joe users"
  ];

  # TODO socket activation
  systemd.services.cal = {
    # Deno writes its module cache under $HOME, which DynamicUser does not give
    # us; point it at /var/cache/cal instead.
    # TODO node
    environment.DENO_DIR = "/var/cache/cal";
    serviceConfig = {
      Type = "exec";
      DynamicUser = true;
      WorkingDirectory = "/opt/cal";
      StateDirectory = "cal";
      CacheDirectory = "cal";
      ExecStart = "${pkgs.deno}/bin/deno run --allow-net --allow-read --allow-write=/opt/cal/web/events,/opt/cal/web/_site web/server.ts";
    };
  };

  # TODO allocate domain?
  services.nginx.virtualHosts."cal.elmo.mou.fo" = {
    useACMEHost = "elmo.mou.fo";
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:8000";
    };
  };
}