{ resume }:
{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.services.yisroelbaum-web;
  domainName = "yisroelbaum.com";
  resumePackage = resume.packages.${pkgs.stdenv.hostPlatform.system}.default;
  secretFileOption =
    description:
    lib.mkOption {
      type = lib.types.path;
      inherit description;
    };
in
{
  options.services.yisroelbaum-web = {
    enable = lib.mkEnableOption "the yisroelbaum.com web stack";

    secretFiles = {
      borgPassphrase = secretFileOption "Borg repository passphrase file.";
      borgPrivateKey = secretFileOption "Borg repository SSH private key file.";
      forgejoMailerUser = secretFileOption "Forgejo SMTP username file.";
      forgejoMailerPassword = secretFileOption "Forgejo SMTP password file.";
      rabbiGerziEnvironment = secretFileOption "Rabbi Gerzi runtime dotenv file.";
    };
  };

  config = lib.mkIf cfg.enable {
    users.users.${config.services.nginx.user}.extraGroups = [ "acme" ];

    services = {
      jellyfin.enable = true;

      forgejo = {
        enable = true;
        settings = {
          server = {
            ROOT_URL = "https://git.${domainName}/";
            PROTOCOL = "http";
            HTTP_ADDR = "127.0.0.1";
            HTTP_PORT = 3000;
            DOMAIN = "git.${domainName}";
            SSH_PORT = 2222;
            START_SSH_SERVER = true;
          };
          session.COOKIE_SECURE = true;
          service.DISABLE_REGISTRATION = true;
          mailer = {
            ENABLED = true;
            SMTP_ADDR = "in-v3.mailjet.com";
            SMTP_PORT = 587;
            FROM = "me@${domainName}";
          };
        };
        secrets.mailer = {
          USER = cfg.secretFiles.forgejoMailerUser;
          PASSWD = cfg.secretFiles.forgejoMailerPassword;
        };
      };

      rabbi-gerzi = {
        enable = true;
        frontend = {
          hostName = "rabbigerzi.${domainName}";
          nginx = {
            forceSSL = true;
            enableACME = true;
          };
        };
        backend = {
          hostName = "rabbigerziapi.${domainName}";
          environmentFile = cfg.secretFiles.rabbiGerziEnvironment;
          nginx = {
            forceSSL = true;
            enableACME = true;
          };
        };
      };

      nginx = {
        enable = true;
        virtualHosts = {
          "${domainName}" = {
            forceSSL = true;
            enableACME = true;
            locations."/".root = "${resumePackage}";
          };

          "jellyfin.${domainName}" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://localhost:8096";
          };

          "git.${domainName}" = {
            forceSSL = true;
            enableACME = true;
            extraConfig = ''
              client_max_body_size 512M;
            '';
            locations."/" = {
              proxyPass = "http://127.0.0.1:3000";
              recommendedProxySettings = false;
              extraConfig = ''
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
              '';
            };
          };
        };
      };

      borgbackup.jobs.forgejo = {
        paths = [ config.services.forgejo.stateDir ];
        repo = "ssh://n5lniyfd@n5lniyfd.repo.borgbase.com/./repo";
        user = "root";
        group = "root";
        encryption = {
          mode = "repokey-blake2";
          passCommand = "${pkgs.coreutils}/bin/cat ${cfg.secretFiles.borgPassphrase}";
        };
        doInit = true;
        compression = "auto,zstd";
        startAt = "*-*-* 03:15:00";
        persistentTimer = true;
        prune.keep = {
          daily = 7;
          weekly = 4;
          monthly = 6;
        };
        environment.BORG_RSH = "ssh -i ${cfg.secretFiles.borgPrivateKey} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.config/borg/known_hosts";
        preHook = ''
          forgejoWasActive=/root/.cache/borg/forgejo-was-active
          if ${pkgs.systemd}/bin/systemctl is-active --quiet forgejo.service; then
            touch "$forgejoWasActive"
            ${pkgs.systemd}/bin/systemctl stop forgejo.service
          else
            rm -f "$forgejoWasActive"
          fi
        '';
        postHook = ''
          forgejoWasActive=/root/.cache/borg/forgejo-was-active
          if [ -e "$forgejoWasActive" ]; then
            ${pkgs.systemd}/bin/systemctl start forgejo.service
            rm -f "$forgejoWasActive"
          fi
        '';
      };
    };

    security.acme = {
      defaults = {
        webroot = "/var/lib/acme/acme-challenge/";
        email = "yisroel.d.baum@gmail.com";
      };
      acceptTerms = true;
    };

    systemd.services.borgbackup-job-forgejo = {
      after = [
        "sops-install-secrets.service"
        "network-online.target"
      ];
      wants = [ "network-online.target" ];
    };
  };
}