{ config, lib, pkgs, inputs, evalConfig, ... }:

{
  services.nginx.virtualHosts."tracktrain.ilztalbahn.eu" = {
    locations."/api" = {
      proxyPass = "http://192.168.42.41:4000";
      proxyWebsockets = true;
      extraConfig = ''
        add_header 'Access-Control-Allow-Origin' '*' always;
      '';
    };
    # locations."/metrics/" = {
    #   proxyPass = "http://localhost:2342";
    #   proxyWebsockets = true;
    #   extraConfig = ''
    #     rewrite  ^/metrics/(.*)  /$1 break;
    #   '';
    # };
    enableACME = true;
    forceSSL = true;
  };

  # services.prometheus = {
  #   enable = true;
  #   port = 9001;
  #   scrapeConfigs = [ {
  #     job_name = "tracktrain";
  #     static_configs = [{
  #       targets = [  "192.168.42.41:4000" ];
  #     }];
  #   } ];
  # };

  # services.grafana = {
  #   enable = true;
  #   settings.server = {
  #     serve_from_sub_path = true;
  #     domain = "tracktrain.ilztalbahn.eu";
  #     root_url = "%(protocol)s://%(domain)s:/metrics/";
  #     http_port = 2342;
  #     http_addr = "0.0.0.0";
  #   };

  #   provision = {
  #     enable = true;
  #     datasources.settings.datasources = [ {
  #       url = "http://localhost:9001";
  #       type = "prometheus";
  #       name = "prometheus";
  #     } ];
  #   };
  # };

  networking.firewall.allowedTCPPorts = [ 443 ];

  containers.tracktrain = {
    privateNetwork = true;
    hostAddress = "192.168.42.40";
    localAddress = "192.168.42.41";
    autoStart = true;

    bindMounts = {
      "/persist" = {
        hostPath = "/persist/containers/tracktrain";
        isReadOnly = false;
      };
    };
    path = (evalConfig {
      hosts = { };
      groups = { };
    } ({ config, lib, pkgs, profiles, modules, sources, ... }: {
      boot.isContainer = true;
      networking.useDHCP = false;
      users.users.root.hashedPassword = "";
      system.stateVersion = "21.11";

      imports = [ sources.nix-hexchen.nixosModules.profiles.nopersist ];
      networking.firewall.enable = false;
      networking.defaultGateway = {
        address = "192.168.100.1";
        interface = "eth0";
      };

      systemd.services.tracktrain = {
        enable = true;

        description = "tracks trains, hopefully";
        wantedBy = [ "multi-user.target" ];
        after = [ "network.target" ];
        serviceConfig.Type = "simple";
        path = [ pkgs.wget ];
        script = ''
          cd /tmp
          # wget "https://ilztalbahn.eu/wp-content/uploads/2020/07/gtfs.zip"
          ${(pkgs.tracktrain
            # have to remove version constraints because some aren't in 22.05
            .overrideAttrs (old: { patchPhase = ''
              sed -i "s/base.*/base/g" *.cabal
              sed -i "s/^>=.*//g" *.cabal
              sed -i "s/>=.*//g" *.cabal
            ''; }))
           }/bin/tracktrain --dbString="dbname=tracktrain user=tracktrain" --warp.port=4000 +RTS -T
        '';
        startAt = "daily";
      };

      services.postgresql = {
        enable = true;

        ensureDatabases = [ "tracktrain" ];
        ensureUsers = [ {
          name = "tracktrain";
          ensurePermissions = {
            "DATABASE tracktrain" = "ALL PRIVILEGES";
          };
        } ];
        authentication = ''
          local   all   all                              trust
          host    all   all        127.0.0.1/32          trust
        '';
      };

      services.coredns = {
        enable = true;
        config = ''
          .:53 {
          forward . 1.1.1.1
          }
        '';
      };
    })).config.system.build.toplevel;
  };

}