{ config, lib, pkgs, ... }:


let
  mumblesite = pkgs.stdenv.mkDerivation {
    name = "mumble.hacc.space-website";
    src = pkgs.fetchgit {
      url = "https://gitlab.infra4future.de/hacc/infra4future/mumble.infra4future.de";
      rev = "597c4a2fa7a146f2fd58924cb2b181d530a2a866";
      sha256 = "15vh0xqx0xcm09ij877jxkd6gb5nm2hbmyz47y5019xywa766s3h";
    };
    buildPhase = ''
      ${pkgs.jekyll.outPath}/bin/jekyll build
    '';
    installPhase = ''
      mkdir -p $out
      cp -r _site/* $out
    '';
  };
in
{
  services.murmur = {
    enable = true;
    logDays = -1;
    welcometext = "Welcome to mumble4future! Brought to you by infra4future. The server is now reachable under mumble.hacc.space, please update your bookmarks.";
    sslKey = "/var/lib/acme/mumble.hacc.space/key.pem";
    sslCert = "/var/lib/acme/mumble.hacc.space/fullchain.pem";
    bandwidth = 128000;

  };

  networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
  networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];

  services.nginx.virtualHosts =
    let  vhost = {
      forceSSL = true;
      enableACME = true;
      root = mumblesite.outPath;
    };
  in {
    "mumble.infra4future.de" = vhost;
    "mumble.hacc.space" = vhost;
  };

  # set ACLs so that the murmur user can read the certificates
  security.acme.certs."mumble.hacc.space".postRun = "setfacl -Rm u:murmur:rX /var/lib/acme/mumble.hacc.space";
}