#
# CI/CD Woodpecker
#
{
  config,
  lib,
  pkgs,
  ...
}: {
  environment.systemPackages = with pkgs; [
    # Default packages install system-wide
    woodpecker-server
    woodpecker-cli
  ];

  users = {
    users = {
      woodpecker = {
        uid = 3005;
        group = "woodpecker";
        isSystemUser = true;
      };
    };
    groups = {
      woodpecker = {
        gid = 3005;
      };
    };
  };

  systemd.services = {
    woodpecker-server = {
      description = "CI/CD Pipeline Server";
      wantedBy = ["multi-user.target"];
      after = ["network.target" "postgresql.service"];
      requires = ["postgresql.service"];
      script = "${pkgs.woodpecker-server}/bin/woodpecker-server";
      serviceConfig = {
        User = "woodpecker";
        Group = "woodpecker";
        Environment = "HOME=/var/lib/woodpecker";
        EnvironmentFile = config.age.secrets."services/woodpecker/environment".path;
        ReadWritePaths = "/var/lib/woodpecker /var/log/woodpecker";
        NoNewPrivileges = true;
        MemoryDenyWriteExecute = true;
        PrivateDevices = true;
        PrivateTmp = true;
        ProtectHome = true;
        ProtectSystem = "strict";
        ProtectControlGroups = true;
        RestrictSUIDSGID = true;
        RestrictRealtime = true;
        LockPersonality = true;
        ProtectKernelLogs = true;
        ProtectKernelTunables = true;
        ProtectHostname = true;
        ProtectKernelModules = true;
        PrivateUsers = true;
        ProtectClock = true;
        SystemCallArchitectures = "native";
        SystemCallErrorNumber = "EPERM";
        SystemCallFilter = "@system-service";
      };
    };
  };

  systemd.tmpfiles.rules = [
    "d /var/log/woodpecker - woodpecker woodpecker"
  ];

  services.nginx = {
    enable = true;
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedProxySettings = true;
    virtualHosts = {
      "ci.kabtop.de" = {
        enableACME = true;
        forceSSL = true;
        locations."/".proxyPass = "http://localhost:8000";
      };
    };
  };

  age.secrets."services/woodpecker/environment" = {
    file = ../../../secrets/services/woodpecker/environment.age;
    owner = "woodpecker";
  };
}