{ pkgs, ... }:

{
  systemd.tmpfiles.rules = [
    "d /opt/yakatak 0755 joe users"
  ];

  systemd.services.yakatak = {
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "exec";
      DynamicUser = true;
      SupplementaryGroups = "nginx";
      RuntimeDirectory = "yakatak";
      StateDirectory = "yakatak";
      WorkingDirectory = "/opt/yakatak";
    };
    environment = {
      NITRO_UNIX_SOCKET = "/run/yakatak/socket";
      NUXT_DB_PATH = "/var/lib/yakatak/yakatak.db";
    };
    script = ''
      # Hack to make our socket connectable by nginx.
      (
        sleep 5
        chown :nginx /run/yakatak/socket
        chmod g+w /run/yakatak/socket
      ) &

      ${pkgs.nodejs_22}/bin/node .output/server/index.mjs
    '';
  };

  services.nginx.virtualHosts."yakatak.app" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://unix:/run/yakatak/socket";
    };
  };
}