{ pkgs, config, lib, ... }:

let
  mkServiceConfig = name: url: {
    http.routers."${name}" = {
      rule = "Host(`${domain}`) && PathPrefix(`/${name}`)";
      service = "${name}";
      tls.certResolver = "le";
    };
    http.services."${name}" = { loadBalancer.servers = [{ url = url; }]; };
  };
in {
  options.cloud.traefik = {
    gcpKeyFile = mkOption {
      type = types.path;
      description = "The GCP private key file, for Let's Encrypt DNS challenge";
    };

    gcpProjectName = mkOption {
      type = types.str;
      description = "The GCP project name used for managing DNS";
    };

    certsPath = mkOption {
      type = types.str;
      default = "/var/lib/traefik/acme.json";
      description = "The location to read and write the certificates file";
    };
  };

  config.services.traefik = {
    enable = true;

    staticConfigOptions = {
      entrypoints.http.address = ":80";
      entrypoints.http.http.redirections.entryPoint = {
        to = "https";
        scheme = "https";
      };
      entrypoints.https.address = ":443";

      accessLog.format = "json";
      log.level = "warn";

      global.checkNewVersion = false;
      global.sendAnonymousUsage = false;

      metrics.prometheus = {
        addEntryPointsLabels = true;
        addRoutersLabels = true;
        addServicesLabels = true;
      };

      certificatesResolvers.le.acme = {
        email = "franck@fcuny.net";
        storage = cfg.certsPath;
        dnsChallenge.provider = "gcloud";
        dnsChallenge.delayBeforeCheck = 10;
      };
    };
  };

  services.traefik.dynamicConfigOptions =
    mkMerge [ (mkServiceConfig "dash" "http://127.0.0.1:3000/") ];

  # Set up cloudflare key
  config.systemd.services.traefik.environment.GCE_SERVICE_ACCOUNT_FILE =
    cfg.gcpKeyFile;

  config.systemd.services.traefik.environment.GCE_PROJECT = cfg.gcpProjectName;

  # Set up firewall to allow traefik traffic.
  config.networking.firewall.allowedTCPPorts = [ 80 443 ];
  config.networking.firewall.allowedUDPPorts = [ 443 ]; # QUIC
}