{ config, lib, pkgs, ... }:

let
  cfg = config.services.gebos.caddy;

  siteBlock = host: site:
    if site ? staticRoot then ''
      ${host} {
        root * ${site.staticRoot}
        file_server
        try_files {path} /index.html
        encode zstd gzip
      }
    ''
    else if site ? upstream then ''
      ${host} {
        reverse_proxy ${site.upstream}
        encode zstd gzip
      }
    ''
    else if site ? tcpProxy then ''
      ${host}:8883 {
        # TLS termination for MQTT — Caddy's `layer4` app would be ideal here;
        # for now, document that the upstream HiveMQ port is ${site.tcpProxy}.
        # TODO: switch to the caddy-l4 module or terminate TLS in HiveMQ directly.
      }
    ''
    else throw "site `${host}` needs one of: staticRoot, upstream, tcpProxy";
in
{
  options.services.gebos.caddy = {
    enable = lib.mkEnableOption "Gebos Caddy reverse proxy / TLS terminator";
    sites = lib.mkOption {
      type = lib.types.attrsOf lib.types.attrs;
      default = { };
    };
  };

  config = lib.mkIf cfg.enable {
    services.caddy = {
      enable = true;
      email = "ops@ge-bos.de";  # TODO: confirm ACME contact
      extraConfig = lib.concatStringsSep "\n"
        (lib.mapAttrsToList siteBlock cfg.sites);
    };
  };
}