module.nix

flake:
{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.services.sygnal;
  formatter = pkgs.formats.toml { };

  # Cleanup attrset value from null values.
  # This was done to let nix type check fields at the
  # same time be able to render without optional fields.
  optionals =
    v:
    if lib.isAttrs v && !lib.isDerivation v then
      lib.mapAttrs (_: optionals) (lib.filterAttrs (_: x: x != null) v)
    else if lib.isList v then
      map optionals v
    else
      v;
in
{
  options = {
    services.sygnal = {
      enable = lib.mkEnableOption ''
        Sygnal is running.
      '';

      user = lib.mkOption {
        type = lib.types.str;
        default = "sygnal";
        description = "User for running system + access keys";
      };
      group = lib.mkOption {
        type = lib.types.str;
        default = "sygnal";
        description = "Group for running system + acess keys";
      };

      settings = lib.mkOption {
        description = "Configuration for the Sygnal.";
        default = { };
        apply = optionals;
        type = lib.types.submodule {
          freeformType = formatter.type;
          options = {
            port = lib.mkOption {
              type = lib.types.int;
              default = 52334;
              description = "Port to use for passing over proxy";
            };
            apps = lib.mkOption {
              default = { };
              description = "Notification providers to connect to.";
              type =
                with lib.types;
                attrsOf (submodule {
                  options = {
                    type = lib.mkOption {
                      type =
                        with lib.types;
                        enum [
                          "apns"
                          "gcm"
                          "webpush"
                        ];
                      description = "Define the type of push notification provider.";
                    };

                    # FCM (Google Cloud Messaging v1)
                    project_id = lib.mkOption {
                      type = with lib.types; nullOr str;
                      default = null;
                      example = "uz.some.company";
                      description = "Project id for working sygnal push-gateway";
                    };
                    service_account_file = lib.mkOption {
                      type = with lib.types; nullOr path;
                      default = null;
                      example = "/run/secrets/fcm/service";
                      description = lib.mdDoc ''
                        The path for needed informations for sygnal
                      '';
                    };

                    # APNs (Apple Push Notification service)
                    key_id = lib.mkOption {
                      type = with lib.types; nullOr str;
                      default = null;
                      example = "ABCD1234EF";
                      description = "key_id for working sygnal push-gateway";
                    };
                    team_id = lib.mkOption {
                      type = with lib.types; nullOr str;
                      default = null;
                      example = "TEAMID1234";
                      description = "team_id for working sygnal push-gateway";
                    };
                    bundle_id = lib.mkOption {
                      type = with lib.types; nullOr str;
                      default = null;
                      example = "com.example.ios";
                      description = "bundle_id for working sygnal push-gateway";
                    };
                    sandbox = lib.mkOption {
                      type = with lib.types; nullOr bool;
                      default = null; # false
                      example = false;
                      description = "Whether the service is running on sandbox mode.";
                    };
                    send_badge_counts = lib.mkOption {
                      type = with lib.types; nullOr bool;
                      default = null; # true
                      example = false;
                      description = lib.mdDoc ''
                        Whether to send badge counts via APN.
                      '';
                    };
                    key_file = lib.mkOption {
                      type = with lib.types; nullOr path;
                      default = null;
                      example = "/run/secrets/apn/key";
                      description = lib.mdDoc ''
                        The path for needed informations for sygnal
                      '';
                    };

                    # Web push
                    vapid_private_key = lib.mkOption {
                      type = with lib.types; nullOr str;
                      default = null;
                      example = "your-base64url-encoded-private-key";
                      description = lib.mdDoc ''
                        The path for needed informations for sygnal
                      '';
                    };
                    vapid_public_key = lib.mkOption {
                      type = with lib.types; nullOr str;
                      default = null;
                      example = "your-base64url-encoded-public-key";
                      description = lib.mdDoc ''
                        The path for needed informations for sygnal
                      '';
                    };

                    # General parameters
                    inflight_request_limit = lib.mkOption {
                      type = lib.types.number;
                      default = 512;
                    };
                  };
                });
            };
          };
        };
      };

      package = lib.mkOption {
        type = lib.types.package;
        default = flake.packages.${pkgs.stdenv.hostPlatform.system}.default;
        description = ''
          Compiled sygnal package to use with the service.
        '';
      };
    };
  };

  config = lib.mkIf cfg.enable {
    users.users.${cfg.user} = {
      description = "sygnal user";
      isSystemUser = true;
      group = cfg.group;
      useDefaultShell = true;
    };

    users.groups.${cfg.group} = { };
    systemd.targets."sygnal" = { };

    systemd.services.sygnal =
      let
        generated = formatter.generate "config.toml" cfg.settings;
      in
      {
        description = "Welcome to sygnal";

        after = [ "network.target" ];
        wants = [ "network-online.target" ];
        wantedBy = [ "multi-user.target" ];
        restartTriggers = [
          cfg.package
          generated
        ];
        path = [ cfg.package ];

        serviceConfig = {
          User = cfg.user;
          Group = cfg.group;
          Restart = "always";

          ExecStart = "${lib.getExe' cfg.package "sygnal"} -c ${generated}";
          ExecReload = "${pkgs.coreutils}/bin/kill -s HUP $MAINPID";

          StateDirectory = cfg.user;
          # StateDirectoryMode = "0770";
          CapabilityBoundingSet = [
            "AF_NETLINK"
            "AF_INET"
            "AF_INET6"
          ];
          DeviceAllow = [ "/dev/stdin r" ];
          DevicePolicy = "strict";
          # IPAddressAllow = "localhost";
          LockPersonality = true;
          PrivateDevices = true;
          PrivateTmp = true;
          PrivateUsers = false;
          ProtectClock = true;
          ProtectControlGroups = true;
          ProtectHome = true;
          ProtectHostname = true;
          ProtectKernelLogs = true;
          ProtectKernelTunables = true;
          ProtectSystem = "strict";
          ReadOnlyPaths = [ "/" ];
          RemoveIPC = true;
          RestrictAddressFamilies = [
            "AF_NETLINK"
            "AF_INET"
            "AF_INET6"
            "AF_UNIX"
          ];
          RestrictNamespaces = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          SystemCallArchitectures = "native";
          SystemCallFilter = [
            "@system-service"
            "~@privileged"
            "~@resources"
            "@pkey"
          ];
          # UMask = "0027";
        };
      };
  };
}