{ config, lib, pkgs, ... }:

let
  cfg = config.services.gebos.supabase;
  composeDir = ../supabase;
in
{
  options.services.gebos.supabase = {
    enable = lib.mkEnableOption "Supabase stack via vanilla docker-compose";

    postgresHost = lib.mkOption {
      type = lib.types.str;
      description = "External Postgres host (db-host).";
    };
    postgresPort = lib.mkOption {
      type = lib.types.port;
      default = 5432;
    };
    studioBindAddress = lib.mkOption {
      type = lib.types.str;
      default = "127.0.0.1";
      description = "Studio is intentionally never exposed publicly.";
    };
  };

  config = lib.mkIf cfg.enable {
    virtualisation.docker.enable = true;

    systemd.tmpfiles.rules = [
      "d /var/lib/gebos-supabase 0750 root root - -"
    ];

    # Copy the vendored compose bundle into place at activation time so
    # changes under nix/supabase/ are deployed atomically. Kong's declarative
    # config is mounted from here by the compose file (relative ./kong.yml
    # resolves against WorkingDirectory).
    environment.etc."gebos/supabase/docker-compose.yml".source =
      "${composeDir}/docker-compose.yml";
    environment.etc."gebos/supabase/kong.yml".source =
      "${composeDir}/kong.yml";
    environment.etc."gebos/supabase/kong-entrypoint.sh".source =
      "${composeDir}/kong-entrypoint.sh";

    systemd.services.gebos-supabase = {
      description = "Gebos — Supabase compose stack";
      after = [ "docker.service" "network-online.target" ];
      wants = [ "docker.service" "network-online.target" ];
      wantedBy = [ "multi-user.target" ];

      # `docker compose up -d` only recreates containers whose definition
      # changed, but the unit must re-run for it to notice at all.
      restartTriggers = [
        "${composeDir}/docker-compose.yml"
        "${composeDir}/kong.yml"
        "${composeDir}/kong-entrypoint.sh"
      ];

      environment = {
        POSTGRES_HOST = cfg.postgresHost;
        POSTGRES_PORT = toString cfg.postgresPort;
        POSTGRES_DB = "postgres";
        STUDIO_BIND = cfg.studioBindAddress;
      };

      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
        WorkingDirectory = "/etc/gebos/supabase";
        # POSTGRES_PASSWORD, JWT_SECRET, ANON_KEY, SERVICE_ROLE_KEY, DASHBOARD_PASSWORD.
        # Rendered by sops-nix from nix/secrets/secrets.yaml — see gebos-secrets module.
        EnvironmentFile = config.services.gebos.secrets.envFile;
        ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
        ExecStop  = "${pkgs.docker}/bin/docker compose down";
      };
    };
  };
}