{ pkgs, ... }:

{
  systemd.tmpfiles.rules = [
    "d /opt/cal 0755 joe users"
  ];

  systemd.sockets.cal = {
    wantedBy = [ "sockets.target" ];
    socketConfig = {
      ListenStream = "/run/cal/socket";
      SocketGroup = "nginx";
      SocketMode = "0660";
    };
  };

  systemd.services.cal = {
    serviceConfig = {
      Type = "exec";
      DynamicUser = true;
      WorkingDirectory = "/opt/cal";
      StateDirectory = "cal";
      ExecStart = "${pkgs.nodejs-slim_26}/bin/node server.ts";
    };
  };

  # TODO allocate domain?
  services.nginx.virtualHosts."cal.elmo.mou.fo" = {
    useACMEHost = "elmo.mou.fo";
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://unix:/run/cal/socket";
    };
  };
}