{ pkgs, ... }:

{
  nixpkgs.config.packageOverrides = pkgs: {
    redlib = pkgs.redlib.overrideAttrs (oldAttrs: rec {
      # https://github.com/NixOS/nixpkgs/blob/5eac22df8e2b0d1512db0c8979db844547bcc740/pkgs/by-name/re/redlib/package.nix
      version = "0.35.1-unstable-2024-11-01";
      src = pkgs.fetchFromGitHub {
        owner = "redlib-org";
        repo = "redlib";
        rev = "f03bdcf472d32d51a1093528071dc329b348379d";
        hash = "sha256-fbk0m20NpaUCWvH/l9hfmx+VKw4U3pkTkXdAeHL7bHs=";
      };
      cargoDeps = oldAttrs.cargoDeps.overrideAttrs (_: {
        inherit src;
        outputHash = "sha256-giFf0GEiUgkTrv99psPYguU6DDj/Qje9x+fEED4C6cE=";
      });
      checkFlags = [
        # All these test try to connect to Reddit.
        # utils.rs
        "--skip=test_fetching_subreddit_quarantined"
        "--skip=test_fetching_nsfw_subreddit"
        "--skip=test_fetching_ws"

        # client.rs
        "--skip=test_obfuscated_share_link"
        "--skip=test_share_link_strip_json"
        "--skip=test_localization_popular"
        "--skip=test_private_sub"
        "--skip=test_banned_sub"
        "--skip=test_gated_sub"

        # subreddit.rs
        "--skip=test_fetching_subreddit"
        "--skip=test_gated_and_quarantined"

        # user.rs
        "--skip=test_fetching_user"

        # These try to connect to the oauth client
        # oauth.rs
        "--skip=test_oauth_client"
        "--skip=test_oauth_client_refresh"
        "--skip=test_oauth_token_exists"
        "--skip=test_oauth_headers_len"
      ];
    });
  };

  services.libreddit = {
    enable = true;
    package = pkgs.redlib;
    address = "[::1]";
    port = 7682;
  };

  systemd.services.libreddit = {
    environment = {
      REDLIB_DEFAULT_SHOW_NSFW = "on";
      REDLIB_DEFAULT_USE_HLS = "on";
      REDLIB_DEFAULT_WIDE = "on";
      REDLIB_PUSHSHIFT_FRONTEND = "www.reveddit.com";
      REDLIB_ROBOTS_DISABLE_INDEXING = "on";
    };
  };

  services.nginx.virtualHosts."lr.mou.fo" = {
    enableACME = true;
    forceSSL = true;
    locations."/".proxyPass = "http://[::1]:7682";
  };

  systemd.tmpfiles.rules = [
    "d /var/secrets/nitter 0750 root wheel"
  ];

  services.nitter = {
    enable = true;
    # This must be populated manually as per
    # https://github.com/zedeus/nitter/wiki/Guest-Account-Branch-Deployment
    # Alternatively it can use logged in account tokens with
    # https://github.com/PrivacyDevel/nitter/blob/master/twitter_oauth.sh
    guestAccounts = "/var/secrets/nitter/guest-accounts.jsonl";
    server = {
      port = 7873;
      https = true;
      hostname = "ni.mou.fo";
      address = "127.0.0.1";
    };
    preferences = {
      hlsPlayback = true;
    };
  };

  systemd.services.nitter = {
    unitConfig = {
      AssertPathExists = "/var/secrets/nitter/guest-accounts.jsonl";
    };
  };

  services.nginx.virtualHosts."ni.mou.fo" = {
    enableACME = true;
    forceSSL = true;
    locations."/".proxyPass = "http://127.0.0.1:7873";
  };
}