dotfiles/modules/nixos/services/firefly-iii/default.nix

{
  config,
  flake,
  ...
}:
let

  inherit (flake.config.people) user0;
  inherit (flake.config.people.users.${user0}) email;
  inherit (flake.config.services) instances;
  serviceCfg = instances.firefly-iii;
  smtpCfg = instances.smtp;
  hostCfg = instances.web;
  host = serviceCfg.domains.url0;
  dns0 = instances.web.dns.provider0;
  dns0Path = "dns/${dns0}";
  hostSecrets = "/opt/secrets";
in
{
  microvm.vms.${serviceCfg.name} = {
    autostart = true;
    restartIfChanged = true;
    config = {
      system.stateVersion = "24.05";
      time.timeZone = "America/Winnipeg";
      users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
      services = {
        firefly-iii = {
          enable = true;
          dataDir = serviceCfg.varPaths.path0;
          enableNginx = false;
          poolConfig = {
            "listen.owner" = config.services.caddy.user;
            "pm" = "dynamic";
            "pm.max_children" = 32;
            "pm.start_servers" = 2;
            "pm.min_spare_servers" = 2;
            "pm.max_spare_servers" = 4;
            "pm.max_requests" = 500;
          };
          settings = {
            APP_URL = "https://${host}";
            APP_KEY_FILE = "/run/secrets/pass";
            DB_PASSWORD_FILE = "/run/secrets/data";
            DB_CONNECTION = "pgsql";
            DB_HOST = "db";
            DB_DATABASE = "firefly";
            DB_USERNAME = "firefly";
            MAIL_MAILER = smtpCfg.name;
            MAIL_HOST = smtpCfg.hostname;
            MAIL_PORT = smtpCfg.ports.port0;
            MAIL_FROM = smtpCfg.email.address0;
            MAIL_USERNAME = smtpCfg.email.address0;
            MAIL_PASSWORD_FILE = "/run/secrets/smtp";
            MAIL_ENCRYPTION = "tls";
            SITE_OWNER = email.address2;
          };
        };

        firefly-iii-data-importer = {
          enable = true;
        };

        caddy = {
          enable = true;
          virtualHosts."${serviceCfg.interface.ip}" = {
            extraConfig = ''
              root * ${config.services.firefly-iii.package}/public

              file_server

              encode gzip

              php_fastcgi unix//run/phpfpm/firefly-iii.sock
            '';
          };
        };

        postgresql = {
          enable = true;
          ensureDatabases = [ "firefly" ];
          ensureUsers = [
            {
              name = "firefly";
              ensureDBOwnership = true;
            }
          ];
        };

        openssh = {
          enable = true;
          settings = {
            PasswordAuthentication = false;
            PermitRootLogin = "prohibit-password";
          };
        };
      };

      networking.firewall.allowedTCPPorts = [
        22
        80
        serviceCfg.ports.port0
        serviceCfg.ports.port1
      ];
      systemd = {
        network = {
          enable = true;
          networks."20-lan" = {
            matchConfig.Name = "enp0s5";
            addresses = [
              { Address = "${serviceCfg.interface.ip}/24"; }
            ];
            routes = [
              {
                Destination = "${hostCfg.localhost.address1}/0";
                Gateway = serviceCfg.interface.gate;
              }
            ];
            dns = [
              "1.1.1.1"
              "8.8.8.8"
            ];
          };
        };

        tmpfiles.rules = [
          "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
          "Z ${serviceCfg.secretPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
          "Z /var/lib/postgresql 755 postgres postgres -"
        ];
      };

      systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
      microvm = {
        vcpu = 2;
        mem = 3072;
        hypervisor = "qemu";
        interfaces = [
          {
            type = "tap";
            id = serviceCfg.interface.id;
            mac = serviceCfg.interface.mac;
          }
          {
            type = "user";
            id = serviceCfg.interface.idUser;
            mac = serviceCfg.interface.macUser;
          }
        ];
        forwardPorts = [
          {
            from = "host";
            host.port = serviceCfg.interface.ssh;
            guest.port = 22;
          }
        ];
        shares = [
          {
            mountPoint = "/nix/.ro-store";
            proto = "virtiofs";
            source = "/nix/store";
            tag = "read_only_nix_store";
          }
          {
            mountPoint = "/var/lib/${serviceCfg.name}";
            proto = "virtiofs";
            source = "${serviceCfg.mntPaths.path0}/data";
            tag = "${serviceCfg.name}_data";
          }
          {
            mountPoint = "/var/lib/postgresql";
            proto = "virtiofs";
            source = "${serviceCfg.mntPaths.path0}/database";
            tag = "${serviceCfg.name}_database";
          }
          {
            mountPoint = "/run/secrets";
            proto = "virtiofs";
            source = "${hostSecrets}/${serviceCfg.name}";
            tag = "host_secrets";
          }
        ];
      };
    };
  };

  users.users.caddy.extraGroups = [ "acme" ];

  security.acme.certs."${host}" = {
    dnsProvider = dns0;
    environmentFile = config.sops.secrets.${dns0Path}.path;
    group = "caddy";
  };

  systemd.tmpfiles.rules = [
    "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
  ];

  sops = {
    secrets = builtins.listToAttrs (
      map
        (secret: {
          name = "${serviceCfg.name}/${secret}";
          value = {
            path = hostSecrets;
            owner = "root";
            mode = "600";
          };
        })
        [
          "pass"
          "data"
          "smtp"
        ]
    );
  };
  services.caddy.virtualHosts."${host}" = {
    extraConfig = ''
      reverse_proxy ${serviceCfg.interface.ip}:80

      tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}

      encode zstd gzip
    '';
  };
}