{ pkgs, inputs, config, ... }:
let
  # Public domain for this service — set before deploying.
  domain = "upload.otherwhere.app";

  # Non-secret runtime configuration.
  port        = 8390;
  relayUrl    = "wss://relay.otherwhere.app/";
  cdnUrl      = "https://cdn.otherwhere.app";
  bucketName  = "media";

  pkg = inputs.jirorian.packages.${pkgs.system}.default;

  # Wrapper that exports secrets from sops-managed files then execs jirorian.
  # EnvironmentFile cannot be used here because systemd loads it before
  # ExecStartPre runs, so we read secrets inline in ExecStart instead.
  startScript = pkgs.writeShellScript "jirorian-start" ''
    set -euo pipefail
    export R2_ACCESS_KEY_ID=$(cat ${config.sops.secrets.jirorian_r2_access_key_id.path})
    export R2_SECRET_ACCESS_KEY=$(cat ${config.sops.secrets.jirorian_r2_secret_access_key.path})
    export R2_ENDPOINT=$(cat ${config.sops.secrets.jirorian_r2_endpoint.path})
    export SERVICE_NOSTR_PRIVKEY=$(cat ${config.sops.secrets.jirorian_nostr_privkey.path})
    export JIRORIAN_APP_SECRETS=$(cat ${config.sops.secrets.jirorian_app_secrets.path})
    exec ${pkg}/bin/jirorian
  '';
in
{
  # Secrets — add corresponding keys to secrets/bucur.yaml via sops.
  sops.secrets.jirorian_r2_access_key_id  = { owner = "jirorian"; };
  sops.secrets.jirorian_r2_secret_access_key = { owner = "jirorian"; };
  sops.secrets.jirorian_r2_endpoint       = { owner = "jirorian"; };
  sops.secrets.jirorian_nostr_privkey     = { owner = "jirorian"; };
  sops.secrets.jirorian_app_secrets      = { owner = "jirorian"; };

  users.users.jirorian = {
    isSystemUser = true;
    group = "jirorian";
    home = "/var/lib/jirorian";
  };
  users.groups.jirorian = {};

  systemd.services.jirorian = {
    description = "Jirorian — Nostr-native R2 image upload API";
    after = [ "network.target" "sops-nix.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "simple";
      User = "jirorian";
      Group = "jirorian";
      StateDirectory = "jirorian";
      RuntimeDirectory = "jirorian";
      ExecStart = startScript;
      Environment = [
        "JIRORIAN_BASE_URL=https://${domain}"
        "JIRORIAN_PORT=${toString port}"
        "JIRORIAN_DB=/var/lib/jirorian/jirorian.db"
        "R2_BUCKET_NAME=${bucketName}"
        "R2_CDN_URL=${cdnUrl}"
        "SERVICE_RELAY_URL=${relayUrl}"
      ];
      Restart = "on-failure";
      RestartSec = 5;
    };
  };

  # Caddy reverse proxy fragment — picked up via the glob import in caddy.nix.
  environment.etc."caddy/Caddyfile.d/jirorian.caddyfile".text = ''
    ${domain} {
      reverse_proxy localhost:${toString port}
    }
  '';
}