{ config, lib, pkgs, ... }:

let
  cfg = config.services.re-server;
  re-server = import /home/morj/projects/re/default.nix { inherit pkgs; };
in {
  options.services.re-server = {
    enable = lib.mkEnableOption "re-server";

    port = lib.mkOption {
      type = lib.types.port;
      default = 8040;
      description = lib.mdDoc ''
        Port to listen on. Note that service always binds to 127.0.0.1
      '';
    };

    user = lib.mkOption {
      type = lib.types.str;
      default = "root";
      example = "yourUser";
      description = lib.mdDoc ''
        The user to service as. Recommended option: administrator user.
      '';
    };

    group = lib.mkOption {
      type = lib.types.str;
      default = "root";
      example = "yourGroup";
      description = lib.mdDoc ''
        The group to service as. Recommended option: administrator group.
      '';
    };

    configPath = lib.mkOption {
      type = lib.types.path;
      example = "/home/administrator/.config/re.ron";
      description = lib.mdDoc ''
        Location of redirections file. See service documentation for format.
      '';
    };
  };

  config = lib.mkIf cfg.enable {
    systemd.packages = [re-server];

    systemd.services.re-server = {
      description = "Re-directs service";
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
        User = cfg.user;
        Group = cfg.group;
        ExecStart = ''${re-server}/bin/re-server \
          --port=${toString cfg.port} \
          --config=${cfg.configPath}
        '';

        Restart = "on-failure";
        StandardOutput = "journal";
        StandardError = "journal";

        # Hardening
        # Clean up IPC files after service exits. This service should not produce ipc files, so sure
        RemoveIPC = "true";
        # Prevent acquiring new priviliges, e.g. through execve of a setuid binary
        NoNewPrivileges = true;
        # Removes all real devices from /dev
        PrivateDevices = true;
        # Prevents writing to system clock, which is apperently a thin=
        ProtectClock = true;
        # Disallow 32bit syscalls, which might help filter syscalls for other settings
        SystemCallArchitectures = "native";
        # Prevent creating +x+w memory pages
        MemoryDenyWriteExecute = true;
        # Prevent creating process namespaces
        RestrictNamespaces = true;
        # Prevent chmod from setting suid/sguid; which is not as important as we mount fs RO
        RestrictSUIDSGID = true;
        # Prevent changing hostname
        ProtectHostname = true;
        # Disallow changing kernel personality (signal handler options and similar)
        LockPersonality = true;
        # Prevent modifying kernel options in /proc and /sys
        ProtectKernelTunables = true;
        # Allow only ipv4 and ipv6 sockets
        RestrictAddressFamilies = ["AF_INET" "AF_INET6"];
        # Prevent switching to realtime scheduling
        RestrictRealtime = true;
        # Mount the user filesystems read-only
        ProtectSystem = "strict";
        # Prevent seeing /proc of other users
        ProtectProc = "invisible";
        # Only allow access to own /proc TODO the man says this is rarely useful?
        ProcSubset = "pid";
        # Prevent own tmp directory, because I don't want it to be writable
        PrivateTmp = false;
        # Don't share the keyring (wtf is it) with the user
        KeyringMode = "private";
        # Only allow connections from localhost
        IPAddressAllow = "localhost";
        IPAddressDeny = "any";
      };
    };
  };
}