{ config, lib, pkgs, ... }:
{
  services = let
    sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
  in {
    postgresqlBackup = {
      enable = true;
      compression = "zstd";
      databases = [ "php" "vaultwarden" ];
    };
    postgresql = {
      enable = true;
      ensureDatabases = [ "php" ];
      ensureUsers = [ {
        name = "php";
        ensureDBOwnership = true;
      } ];
    };
    phpfpm.pools.php = {
      user = "php";
      group = "php";
      phpEnv = { PATH = "/run/current-system/sw/bin"; };
      settings = {
        "pm" = "ondemand";
        "pm.max_children" = 4;
        "listen.group" = "nginx";
        "listen.owner" = "nginx";
      };
    };
    vaultwarden = {
      enable = true;
      dbBackend = "postgresql";
      configurePostgres = true;
      package = pkgs.vaultwarden-postgresql;
      environmentFile = "/secrets/vw-token.env";
      config = {
        ROCKET_PORT = 46151;
        SIGNUPS_ALLOWED = false;
        TRASH_AUTO_DELETE_DAYS = 90;
        PASSWORD_HINTS_ALLOWED = false;
        EMERGENCY_ACCESS_ALLOWED = false;
        DOMAIN = "https://bogaledev.ru/vw/";
      };
    };
    forgejo = {
      enable = true;
      database.type = "postgres";
      dump = {
        enable = true;
        type = "tar.zst";
      };
      settings = {
        service = {
          ENABLE_CAPTCHA = true;
          REGISTER_EMAIL_CONFIRM = true;
        };
        mailer = {
          ENABLED = true;
          SMTP_PORT = 25;
          SMTP_ADDR = "localhost";
          FROM = "Forgejo <forgejo@bogaledev.ru>";
        };
        server = {
          SSH_PORT = 32831;
          PROTOCOL = "http+unix";
          ROOT_URL = "https://bogaledev.ru/git/";
          HTTP_ADDR = "/run/forgejo/forgejo.sock";
        };
      };
    };
    nginx = {
      enable = true;
      recommendedTlsSettings = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedBrotliSettings = true;
      virtualHosts.main = let
        phpPool = ''
          index index.php index.html;
          location ~ \.php$ {
            fastcgi_pass unix:${config.services.phpfpm.pools.php.socket};
          }
        '';
        localNetworks = ''
          allow fc00::/64;
          allow fc01::/96;
          allow fc02::/64;
          allow 10.0.0.0/16;
          allow 10.1.0.0/24;
          allow 10.2.0.0/16;
          deny all;
        '';
      in {
        quic = true;
        default = true;
        forceSSL = true;
        root = "/srv/http";
        useACMEHost = "bogaledev.ru";
        extraConfig = ''
          add_header Alt-Svc 'h3=":443"; ma=2592000' always;
          add_header X-Content-Type-Options 'nosniff' always;
        '';
        locations = {
          "/".extraConfig = phpPool;
          "/local/".extraConfig = "${phpPool} ${localNetworks}";
          "/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/";
          "/local/net/".extraConfig = ''
            allow fc01::/64;
            allow 10.1.0.0/16;
            deny all;
          '';
          "/vw/" = {
            proxyWebsockets = true;
            extraConfig = localNetworks;
            proxyPass = "http://localhost:46151";
          };
          "/grafana/" = {
            proxyWebsockets = true;
            extraConfig = localNetworks;
            proxyPass = "http://unix:/run/grafana/grafana.sock:/";
          };
        };
      };
    };
  };
}