{ pkgs, ... }:

{
  systemd.tmpfiles.rules = [
    "d /opt/clippersnip 0755 joe users"
    "e /var/lib/private/clippersnip - - - 365d"
  ];

  systemd.sockets.clippersnip = {
    wantedBy = [ "sockets.target" ];
    socketConfig = {
      ListenStream = "/run/clippersnip/socket";
      SocketGroup = "nginx";
      SocketMode = "0660";
    };
  };

  systemd.services.clippersnip = {
    path = [ pkgs.ffmpeg-headless ];
    environment.CLIPS_DIR = "/var/lib/clippersnip";
    serviceConfig = {
      Type = "exec";
      DynamicUser = true;
      WorkingDirectory = "/opt/clippersnip";
      StateDirectory = "clippersnip";
      ExecStart = "${pkgs.nodejs-slim_24}/bin/node server.ts";
    };
  };

  # TODO allocate domain?
  services.nginx.virtualHosts."cs.elmo.mou.fo" = {
    useACMEHost = "elmo.mou.fo";
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://unix:/run/clippersnip/socket";
    };
    locations."/c/" = {
      proxyPass = "http://unix:/run/clippersnip/socket";
      extraConfig = ''
        auth_request off;
        proxy_buffering off;
      '';
    };
    # ffmpeg can run for minutes.
    locations."/api/clip" = {
      proxyPass = "http://unix:/run/clippersnip/socket";
      extraConfig = ''
        proxy_read_timeout 600s;
      '';
    };
    # Serve audio HTTP Range requests directly.
    locations."/api/audio" = {
      proxyPass = "http://unix:/run/clippersnip/socket";
      extraConfig = ''
        proxy_buffering off;
        proxy_read_timeout 300s;
      '';
    };
  };

  services.oauth2-proxy.nginx.virtualHosts."cs.elmo.mou.fo" = { };
}