{ pkgs, config, ... }:
let
  server_name = "sorre.xyz";
  matrix_hostname = "matrix.${server_name}";
  #admin_email = "gloss_unranked088@simplelogin.com";

  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/server`
  well_known_server = pkgs.writeText "well-known-matrix-server" ''
    {
      "m.server": "${matrix_hostname}"
    }
  '';

  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/client`
  well_known_client = pkgs.writeText "well-known-matrix-client" ''
    {
      "m.homeserver": {
        "base_url": "https://${matrix_hostname}"
      }
    }
  '';
in
{
  imports = [ ./acme.nix ];

  networking.firewall.allowedTCPPorts = [
    80
    443
    8448
  ];
  networking.firewall.allowedUDPPorts = [
    80
    443
    8448
  ];

  services.matrix-conduit = {
    enable = true;
    settings.global.server_name = server_name;
    settings.global.allow_registration = false;
  };

  services.nginx = {
    enable = true;
    recommendedProxySettings = true;

    virtualHosts."${matrix_hostname}" = {
      enableACME = true;
      forceSSL = true;

      listen = [
        {
          addr = "0.0.0.0";
          port = 443;
          ssl = true;
        }
        {
          addr = "[::]";
          port = 443;
          ssl = true;
        }
        {
          addr = "0.0.0.0";
          port = 8448;
          ssl = true;
        }
        {
          addr = "[::]";
          port = 8448;
          ssl = true;
        }
      ];
      locations."/_matrix/" = {
        proxyPass = "http://backend_conduit$request_uri";
        proxyWebsockets = true;
        extraConfig = ''
          proxy_set_header Host $host;
          proxy_buffering off;
        '';
      };
      extraConfig = ''
        merge_slashes off;
      '';
    };

    virtualHosts."${server_name}" = {
      enableACME = true;
      forceSSL = true;

      locations = {
        "=/.well-known/matrix/server" = {
          alias = "${well_known_server}";
          extraConfig = ''
            # Set the header since by default NGINX thinks it's just bytes
            default_type application/json;
          '';
        };
        "=/.well-known/matrix/client" = {
          # Use the contents of the derivation built previously
          alias = "${well_known_client}";

          extraConfig = ''
            # Set the header since by default NGINX thinks it's just bytes
            default_type application/json;

            # https://matrix.org/docs/spec/client_server/r0.4.0#web-browser-clients
            add_header Access-Control-Allow-Origin "*";
          '';
        };
      };
    };

    upstreams."backend_conduit".servers = {
      "[::1]:${toString config.services.matrix-conduit.settings.global.port}" = { };
    };
  };
}