{ config, lib, pkgs, ... }:

let
  cfg = config.services.gebos.supabase;
  composeDir = ../supabase;
in
{
  options.services.gebos.supabase = {
    enable = lib.mkEnableOption "Supabase stack via vanilla docker-compose";

    postgresHost = lib.mkOption {
      type = lib.types.str;
      description = "External Postgres host (db-host).";
    };
    postgresPort = lib.mkOption {
      type = lib.types.port;
      default = 5432;
    };
    studioBindAddress = lib.mkOption {
      type = lib.types.str;
      default = "127.0.0.1";
      description = "Studio is intentionally never exposed publicly.";
    };
  };

  config = lib.mkIf cfg.enable {
    virtualisation.docker.enable = true;

    systemd.tmpfiles.rules = [
      "d /var/lib/gebos-supabase 0750 root root - -"
    ];

    # Copy the vendored compose file into place at activation time so changes
    # to nix/supabase/docker-compose.yml are deployed atomically.
    environment.etc."gebos/supabase/docker-compose.yml".source =
      "${composeDir}/docker-compose.yml";

    systemd.services.gebos-supabase = {
      description = "Gebos — Supabase compose stack";
      after = [ "docker.service" "network-online.target" ];
      wants = [ "docker.service" "network-online.target" ];
      wantedBy = [ "multi-user.target" ];

      environment = {
        POSTGRES_HOST = cfg.postgresHost;
        POSTGRES_PORT = toString cfg.postgresPort;
        POSTGRES_DB = "postgres";
        STUDIO_BIND = cfg.studioBindAddress;
      };

      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
        WorkingDirectory = "/etc/gebos/supabase";
        EnvironmentFile = "/etc/gebos/secrets.env";  # POSTGRES_PASSWORD, JWT_SECRET, ANON_KEY, SERVICE_ROLE_KEY, DASHBOARD_PASSWORD
        ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
        ExecStop  = "${pkgs.docker}/bin/docker compose down";
      };
    };
  };
}