{ config, pkgs, ... }:

{
  # Admin password is managed by agenix.
  # Create secrets/nextcloud-admin-pass.age and add it to secrets.nix,
  # then run: agenix -e secrets/nextcloud-admin-pass.age
  age.secrets."nextcloud-admin-pass" = {
    file = ./secrets/nextcloud-admin-pass.age;
    owner = "nextcloud";
    group = "nextcloud";
    mode = "0400";
  };

  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud33;

    hostName = "nextcloud.srazka.com";
    https = true;

    config = {
      adminuser = "admin-reudy";
      adminpassFile = config.age.secrets."nextcloud-admin-pass".path;
      dbtype = "sqlite";
    };

    # Tell Nextcloud it's behind a trusted reverse proxy.
    settings = {
      trusted_proxies = [ "127.0.0.1" ];
      overwriteprotocol = "https";
      overwritehost = "nextcloud.srazka.com";
      default_phone_region = "NL";
    };
  };

  # Let Caddy handle TLS termination; nginx only listens on localhost.
  # The nextcloud module creates the virtualhost at hostName; we override
  # its listen address here.
  services.nginx.virtualHosts.${config.services.nextcloud.hostName}.listen = [
    {
      addr = "127.0.0.1";
      port = 8081;
    }
  ];

  # The cron timer can fire before nextcloud-setup.service has finished on
  # first boot, causing a "Not installed" failure. Make the cron service wait
  # for setup to complete before it's allowed to run.
  systemd.services.nextcloud-cron = {
    after = [ "nextcloud-setup.service" ];
    requires = [ "nextcloud-setup.service" ];
  };
}