{ config, pkgs, ... }:

{
  # Admin password is managed by agenix.
  # Create secrets/nextcloud-admin-pass.age and add it to secrets.nix,
  # then run: agenix -e secrets/nextcloud-admin-pass.age
  age.secrets."nextcloud-admin-pass" = {
    file = ./secrets/nextcloud-admin-pass.age;
    owner = "nextcloud";
    group = "nextcloud";
    mode = "0400";
  };

  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud31;

    hostName = "nextcloud.srazka.com";
    https = true;

    # Let Caddy handle TLS termination; nginx only listens on localhost.
    # The nextcloud module creates the virtualhost at hostName; we override
    # its listen address here.
    services.nginx.virtualHosts.${config.services.nextcloud.hostName}.listen = [
      {
        addr = "127.0.0.1";
        port = 8081;
      }
    ];

    config = {
      adminuser = "admin";
      adminpassFile = config.age.secrets."nextcloud-admin-pass".path;
      dbtype = "sqlite";
    };

    # Tell Nextcloud it's behind a trusted reverse proxy.
    settings = {
      trusted_proxies = [ "127.0.0.1" ];
      overwriteprotocol = "https";
      overwritehost = "nextcloud.srazka.com";
      default_phone_region = "NL";
    };
  };
}