# tracker: single-host project tracker web app (hackerman edition).
# Wraps the prebuilt Go binary in ./tracker-bin; rebuild it with
#   CGO_ENABLED=0 go build -o tracker-bin .
{ config, lib, pkgs, ... }:

with lib;

let
  cfg = config.services.tracker;

  trackerPackage = pkgs.stdenvNoCC.mkDerivation {
    pname = "tracker";
    version = "0.1.0";
    src = ./tracker-bin;
    dontUnpack = true;
    dontBuild = true;
    installPhase = ''
      install -Dm755 $src $out/bin/tracker
    '';
  };
in
{
  options.services.tracker = {
    enable = mkEnableOption "tracker project tracker web app";

    address = mkOption {
      type = types.str;
      default = ":8420";
      description = "Address for the tracker web server to listen on.";
    };

    openFirewall = mkOption {
      type = types.bool;
      default = true;
      description = "Open the firewall for the tracker port on the tailscale interface.";
    };
  };

  config = mkIf cfg.enable {
    users.users.tracker = {
      isSystemUser = true;
      group = "tracker";
      description = "tracker service user";
    };
    users.groups.tracker = { };

    systemd.services.tracker = {
      description = "tracker project tracker (hackerman edition)";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];

      serviceConfig = {
        User = "tracker";
        Group = "tracker";
        StateDirectory = "tracker";
        ExecStart = "${trackerPackage}/bin/tracker -addr ${cfg.address} -db /var/lib/tracker/tracker.db";
        Restart = "on-failure";
        RestartSec = 5;

        NoNewPrivileges = true;
        ProtectSystem = "strict";
        ProtectHome = true;
        PrivateTmp = true;
        PrivateDevices = true;
        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
      };
    };

    networking.firewall.interfaces."tailscale0".allowedTCPPorts =
      mkIf cfg.openFirewall [ (toInt (removePrefix ":" cfg.address)) ];
  };
}