{ config, lib, pkgs, sources, ... }:

{
  hexchen.bindmounts."/var/lib/murmur" = "/persist/var/lib/murmur";

  services.murmur = {
    enable = true;
    logDays = -1;
    welcometext = "Welcome to mumble4future! Brought to you by infra4future. The server is now reachable under mumble.hacc.space, please update your bookmarks.";
    sslKey = "/var/lib/acme/mumble.hacc.space/key.pem";
    sslCert = "/var/lib/acme/mumble.hacc.space/fullchain.pem";
    bandwidth = 128000;
  };

  networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
  networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];

  # create ssl certs for all used domains
  services.nginx.virtualHosts = let
    vhost = {
      enableACME = true;
      forceSSL = true;
    };
  in {
    "mumble.hacc.space" = vhost;
    "mumble.infra4future.de" = vhost;
  };
  
  # create group to share the certs
  users.groups.mumblecert = {};
  users.users.nginx.extraGroups = [ "mumblecert" ];
  users.users.murmur.extraGroups = [ "mumblecert" ];

 # merge the certs into one and reload murmur on update
  security.acme.certs."mumble.hacc.space" = {
    group = "mumblecert";
    extraDomainNames = [ "pad.infra4future.de" ];
    reloadServices = [ "murmur" ];
  };


}