{ inputs, flake, self }:
{ config, pkgs, lib, ... }: let
  cfg = config.services.vproxy-rest;
  system = pkgs.system;
  domains = ["vproxy.cc"];
  serverPort=52021;
  dbPort=50802;
  dbName="proxystore";
  staticPath="/var/vproxy/static";
  #NOTE: unsafe use this password in prod
  postgresInitialPassword="39nNn6I97AyKO5wVGkEkmKAgDVaw2H3IPLLNNxbveW3YQPP";

  #FIXME: unsafe place for jwt secret
  #FIXME: quickfix db-uri
  postgrestConfig = pkgs.writeText "postgrest.conf" ''
    db-uri = "postgres://postgres:39nNn6I97AyKO5wVGkEkmKAgDVaw2H3IPLLNNxbveW3YQPP@localhost:50802/proxystore"
    db-schema = "vgate,reseller_gateway,public_api,admin"
    jwt-secret = "asdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdf"
    db-anon-role = "anon"
    db-extra-search-path = "vinn, common, public, dataimpulse"
    db-aggregates-enabled = true
    server-port = ${builtins.toString serverPort}
  '';
 
  in {
    options = {
      services.vproxy-rest.enable = lib.mkOption {
        type = lib.types.bool;
        default = false;
      };
    };
    config = lib.mkIf cfg.enable {
      systemd.services.postgrest = {
        description = "PostgREST Service";
        after = [ "network.target" "postgresql.service" ];
        requires = [ "postgresql.service" ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          ExecStart = "${pkgs.postgrest}/bin/postgrest ${postgrestConfig}";
          Restart = "always";
        };
      };
  
      system.activationScripts.copyVproxyFiles = {
        text = ''
          mkdir -p ${staticPath}
          cp -rT ${flake}/static ${staticPath} || true
        '';
      };
  
      services.postgresql = {
       enable = true;
        package = pkgs.postgresql_15;
  
        enableTCPIP = true;
        port = dbPort;
        authentication = builtins.concatStringsSep "\n" [
          "local all         all           trust"
          "host  sameuser    all           127.0.0.1/32 scram-sha-256"
          "host  sameuser    all           ::1/128 scram-sha-256"
          "host  all         all           ::1/128 scram-sha-256"
          "host  all         all           0.0.0.0/0 scram-sha-256"

	  "host  replication postgres      127.0.0.1/32   scram-sha-256"
          "host  replication postgres      ::1/128        scram-sha-256"
        ];
        lazzyExtensions = {
          pg_cron        = true;
          pgjwt          = true;
          pg_net         = true;
          http           = true;
          plsh           = true;
          pg_smtp_client = true;
        };
  
        settings = {
          "cron.host" = "/var/pg_cron";
	  #FIXME: raw db name
          "cron.database_name" = "proxystore";
          "cron.use_background_workers" = "on";
          "pg_net.database_name" = dbName;
	  wal_level = "replica";
          max_wal_senders = 10;
          #password_encryption = "scram-sha-256";
        };
  
        initialScript = pkgs.writeText "init-sql-script" ''
          ALTER USER postgres WITH PASSWORD '${postgresInitialPassword}';
  
          -- even if i will setup it from scratch, this is not works
          -- \cd ${flake}/db/schema
          -- \i 01-init.sql
        '';
      };
  
      networking.firewall = {
        enable = true;
        allowedTCPPorts = [
          dbPort
          serverPort
        ];
      };
  
      systemd.tmpfiles.rules = [
        "d /var/pg_cron 0755 postgres postgres -"
      ];
  
      security.acme = {
        acceptTerms = true;
        defaults.email = "hectic.yukkop@gmail.com";
      };
  
      services.nginx = import ./nginx.nix { inherit self domains pkgs; serverPort = serverPort; };

      systemd.services.nginx.after = [ "network-online.target" "postgresql.service" ];
      systemd.services.nginx.requires = [ "network-online.target" "postgresql.service" ];
    };
  }
