{ config, lib, pkgs, ... }:

let
  cfg = config.services.gebos.caddy;

  # HTTP-style sites: static file server or reverse proxy.
  siteBlock = host: site:
    if site ? staticRoot then ''
      ${host} {
        root * ${site.staticRoot}
        file_server
        try_files {path} /index.html
        encode zstd gzip
      }
    ''
    else if site ? upstream then ''
      ${host} {
        reverse_proxy ${site.upstream}
        encode zstd gzip
      }
    ''
    else throw "site `${host}` needs one of: staticRoot, upstream";
in
{
  options.services.gebos.caddy = {
    enable = lib.mkEnableOption "Gebos Caddy reverse proxy / TLS terminator";
    sites = lib.mkOption {
      type = lib.types.attrsOf lib.types.attrs;
      default = { };
    };
  };

  config = lib.mkIf cfg.enable {
    services.caddy = {
      enable = true;
      email = "ops@gebos.online";  # TODO: confirm ACME contact
      extraConfig = lib.concatStringsSep "\n" (lib.mapAttrsToList siteBlock cfg.sites);
    };
  };
}