{ pkgs, inputs, config, lib, ... }:

with lib;

let
  cfg = config.my.services.traefik;
  domainPublic = "fcuny.net";
  domainPrivate = "fcuny.xyz";
  mkServiceConfig = name: url: domain: certResolver: {
    http.routers."${name}.${domain}" = {
      rule = "Host(`${name}.${domain}`)";
      service = "${name}.${domain}";
      tls.certResolver = certResolver;
    };
    http.services."${name}.${domain}" = {
      loadBalancer.servers = [{ url = url; }];
    };
  };
in {
  options.my.services.traefik = with lib; {
    enable = mkEnableOption "traefik router";
  };

  config = lib.mkIf cfg.enable {
    age.secrets.traefik_gcp_sa = {
      file = ../../../secrets/traefik/gcp_service_account.json.age;
      owner = "traefik";
    };

    services.traefik = {
      enable = true;

      staticConfigOptions = {
        metrics.prometheus = {
          addEntryPointsLabels = true;
          addRoutersLabels = true;
          addServicesLabels = true;
        };

        global = {
          checkNewVersion = false;
          sendAnonymousUsage = false;
        };

        accessLog.format = "json";
        log.level = "warn";

        entryPoints.http.http.redirections = {
          entryPoint.to = "https";
          entryPoint.scheme = "https";
          entryPoint.permanent = true;
        };

        entryPoints.http.address = ":80";
        entryPoints.https.address = ":443";
        # the default is 8080, which conflict with unifi
        entryPoints.traefik.address = ":8090";

        api = {
          dashboard = true;
          insecure = true;
        };

        # The unifi controller runs on HTTPS with a self-signed
        # certificate, as a result we need to accept insecure
        # certificates.
        serversTransport.insecureSkipVerify = true;

        certificatesResolvers = {
          le-http.acme = {
            email = "franck@fcuny.net";
            storage = "/var/lib/traefik/cert.json";
            httpChallenge = { entryPoint = "http"; };
          };
          le-dns.acme = {
            email = "franck@fcuny.net";
            storage = "/var/lib/traefik/cert.json";
            dnsChallenge = {
              provider = "gcloud";
              delayBeforeCheck = 0;
            };
          };
        };
      };
    };

    services.traefik.dynamicConfigOptions = mkMerge [
      (mkServiceConfig "dash" "http://127.0.0.1:3000/" domainPrivate "le-dns")
      (mkServiceConfig "bt" "http://127.0.0.1:9091/" domainPrivate "le-dns")
      (mkServiceConfig "unifi" "https://127.0.0.1:8443/" domainPrivate "le-dns")
      (mkServiceConfig "music" "http://127.0.0.1:4533/" domainPrivate "le-dns")
      (mkServiceConfig "git" "http://127.0.0.1:8002/" domainPrivate "le-dns")
      (mkServiceConfig "git" "http://127.0.0.1:8002/" domainPublic "le-http")
    ];

    systemd.services.traefik.environment.GCE_SERVICE_ACCOUNT_FILE =
      config.age.secrets.traefik_gcp_sa.path;
    systemd.services.traefik.environment.GCE_PROJECT = "fcuny-homelab";

    networking.firewall.allowedTCPPorts = [ 80 443 ];
    networking.firewall.allowedUDPPorts = [ 443 ]; # QUIC
  };
}