{ config, lib, pkgs, ... }:

{
  hexchen.dns.zones."hacc.space".subdomains."mumble".CNAME = [ "hainich.hacc.space" ];
  services.murmur = {
    enable = true;
    logDays = -1;
    welcometext = "Welcome to mumble4future! Brought to you by infra4future. The server is now reachable under mumble.hacc.space, please update your bookmarks.";
    sslKey = "/var/lib/acme/mumble.hacc.space/key.pem";
    sslCert = "/var/lib/acme/mumble.hacc.space/fullchain.pem";
    bandwidth = 128000;

  };

  networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
  networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];

  services.nginx.virtualHosts = let
    vhost = {
          forceSSL = true;
          enableACME = true;
          locations."/" = {
            proxyPass = "https://hacc.4future.dev/infra4future/mumble.infra4future.de/";
          };
        };
    in {
      "mumble.infra4future.de" = vhost;
      "mumble.hacc.space" = vhost;
    };

  # set ACLs so that the murmur user can read the certificates
  security.acme.certs."mumble.hacc.space".postRun = "setfacl -Rm u:murmur:rX /var/lib/acme/mumble.hacc.space";
}