{ pkgs, ... }:

let
  # Being cleaned up; see https://github.com/NixOS/nixpkgs/pull/160346
  customComponentFromGitHub = { name, ... }@attrs:
    { stdenv, fetchFromGitHub }:
    stdenv.mkDerivation {
      inherit name;
      src = fetchFromGitHub (removeAttrs attrs [ "name" ]);
      dontUnpack = true;
      installPhase = "cp -r $src/custom_components/${name} $out";
    };
  mapComponentTmpfile = map (package:
    let drv = pkgs.callPackage package { };
    in "L+ /var/lib/hass/custom_components/${drv.name} - - - - ${drv}/");
in {
  systemd.tmpfiles.rules =
    [ "d /var/lib/hass/custom_components 0700 hass hass" ]
    ++ mapComponentTmpfile [
      (customComponentFromGitHub {
        name = "auth_header";
        owner = "BeryJu";
        repo = "hass-auth-header";
        rev = "v1.10";
        hash = "sha256-dSmY3d8Kx0pXl+20dTGAYgjSH6OhNh53jPX7VLCZs7Y=";
      })
      (customComponentFromGitHub {
        name = "tuya_local";
        owner = "make-all";
        repo = "tuya-local";
        rev = "2023.9.1";
        hash = "sha256-uHImitvHFU7JoBx+aKzZuvpKl2tJCXwsxxk+sJ1+igk=";
      })
    ];

  services.postgresql = {
    enable = true;
    ensureDatabases = [ "hass" ];
    ensureUsers = [{
      name = "hass";
      ensurePermissions = { "DATABASE hass" = "ALL PRIVILEGES"; };
    }];
  };

  services.home-assistant = {
    enable = true;
    extraPackages = ps: with ps; [ psycopg2 ];
    extraComponents = [
      "androidtv_remote"
      "apple_tv"
      "cast"
      "homekit_controller"
      "hue"
      "spotify"
      "esphome"
      "met"
      "radio_browser"
    ];
    config = {
      default_config = { };
      http = {
        server_host = "::1";
        trusted_proxies = [ "::1" ];
        use_x_forwarded_for = true;
      };
      recorder.db_url = "postgresql://@/hass";
      auth_header = { };
    };
  };

  services.nginx.virtualHosts."ha.weebnix.mou.fo" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://[::1]:8123";
      proxyWebsockets = true;
      extraConfig = ''
        # This is frequently used in examples but without clear explanation. It
        # might help with WebSockets.
        proxy_buffering off;
        # oauth2_proxy NixOS module sets some non-standard headers, but we need
        # the preferred_username claim.
        auth_request_set $preferred_username $upstream_http_x_auth_request_preferred_username;
        proxy_set_header X-Forwarded-Preferred-Username $preferred_username;
      '';
    };
  };

  # TODO how to configure for multiple domains?
  services.oauth2_proxy = {
    enable = true;
    nginx.virtualHosts = [ "ha.weebnix.mou.fo" ];
    setXauthrequest = true;
    # https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider/#keycloak-oidc-auth-provider
    provider = "keycloak-oidc";
    clientID = "ha.weebnix.mou.fo";
    # Sets OAUTH2_PROXY_COOKIE_SECRET and OAUTH2_PROXY_CLIENT_SECRET.
    keyFile = "/var/lib/secrets/oauth2-proxy.env";
    redirectURL = "https://ha.weebnix.mou.fo/oauth2/callback";
    email.domains = [ "*" ];
    extraConfig = {
      "oidc-issuer-url" = "https://kc.weebnix.mou.fo/realms/staging";
      "code-challenge-method" = "S256";
      # TODO this is specific to HA. move to nginx config?
      "skip-auth-route" = "^/api/";
    };
  };
}