{ config, lib, pkgs, ... }:

let
  cfg = config.services.gebos.ingester;
  ingester = pkgs.callPackage ../../ingester { };
in
{
  options.services.gebos.ingester = {
    enable = lib.mkEnableOption "Gebos MQTT → Postgres ingester";
    mqttBroker = lib.mkOption {
      type = lib.types.str;
      default = "tcp://127.0.0.1:1883";
      example = "tcp://127.0.0.1:1883";
    };
    postgresUrl = lib.mkOption {
      type = lib.types.str;
      default = "postgres://gebos_ingest@127.0.0.1:5432/postgres?sslmode=require";
      description = "DSN without password — password comes from EnvironmentFile.";
    };
  };

  config = lib.mkIf cfg.enable {
    systemd.services.gebos-ingester = {
      description = "Gebos MQTT → Postgres ingester";
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];

      environment = {
        GEBOS_MQTT_BROKER = cfg.mqttBroker;
        GEBOS_POSTGRES_URL = cfg.postgresUrl;
      };

      serviceConfig = {
        ExecStart = "${ingester}/bin/gebos-ingester";
        DynamicUser = true;
        # GEBOS_POSTGRES_PASSWORD. Rendered by sops-nix — see gebos-secrets module.
        EnvironmentFile = config.services.gebos.secrets.envFile;
        Restart = "on-failure";
        RestartSec = "5s";
      };
    };
  };
}