{ config, lib, pkgs, ... }:

with lib;

let
  cfg = config.services.fdroidRepo;
in {
  options.services.fdroidRepo = {
    enable = mkEnableOption "static F-Droid repo hosting via nginx";

    domain = mkOption {
      type = types.str;
      description = "Domain the repo is served from, e.g. apps.example.com";
    };

    repoPath = mkOption {
      type = types.path;
      default = "/var/lib/fdroid-repo";
      description = "Directory containing the synced repo/ output (index-v1.json, index-v2.json, apks, icons).";
    };
  };

  config = mkIf cfg.enable {
    services.nginx = {
      enable = true;
      virtualHosts.${cfg.domain} = {
        enableACME = true;
        forceSSLRedirect = true;
        root = cfg.repoPath;
      };
    };

    # Requires security.acme.defaults.email and security.acme.acceptTerms = true
    # to be set in your top-level NixOS config.

    systemd.tmpfiles.rules = [
      "d ${cfg.repoPath} 0755 nginx nginx -"
    ];
  };
}