{config, pkgs, lib, ...}: 
let
  cfg = config.wilkuu.services.vaultwarden; 
  hostname = config.networking.hostName; 
in 
{
  options.wilkuu.services.vaultwarden = with lib; {
    domain = mkOption {
      type = types.str; 
      default = "bitwarden.${hostname}.local"; 
      example = "bitwarden.wilkuu.xyz"; 
      description = "Domain for http connections.";  
    };  
    doACME = mkEnableOption "Enable ACME for vaultwarden here";
    enable = mkEnableOption "Enable the vaultwarden service"; 
    backupDir = mkOption { 
     type = types.path; 
     description = "Storage localtion for Vaultwarden user data backup";
     default = "/srv/data/vaultwarden";
     example = "/srv/data/vaultwarden";
    }; 
    signupWhitelist = mkOption {
      type = types.listOf types.str; 
      default = []; 
      example = ["wilkuu.xyz"]; 
      description = "Domains that can sign up on vaultwarden";
    }; 
  };

  config = lib.mkIf cfg.enable (let 
    sopsPath = ../secrets/${hostname}/vaultwarden.yaml;
    secrets = ["admin_token"]; 
    toSops  = (sname: "vaultwarden/${sname}");
    toCredfilePath = (name: config.sops.secrets.${toSops name}.path); 
  in {
     networking.hosts = {
      "127.0.0.1" = [cfg.domain];
     };

    sops.secrets = 
      (lib.genAttrs (map toSops secrets) 
        (name: {
          sopsFile = sopsPath; 
          mode = "0440"; 
          owner = "vaultwarden";  
        }));   

    sops.templates.vaultwardenEnvFile.content = ''
      ADMIN_TOKEN=${config.sops.placeholder."vaultwarden/admin_token"}
    '';
    
    services.nginx.virtualHosts."${cfg.domain}" = {
      enableACME = cfg.doACME;
      addSSL = cfg.doACME; 
      locations."/" = {
        proxyPass = "http://localhost:3222"; 
        recommendedProxySettings = true;
      };
    };

    services.vaultwarden = {
      enable = cfg.enable; 
      backupDir = "/srv/data/vaultwarden";
      config = {
        DOMAIN=cfg.domain;
        ROCKET_ADDRESS = "127.0.0.1";
        ROCKET_PORT ="3222";
        SIGNUPS_DOMAINS_WHITELIST=(lib.concatStringsSep "," cfg.signupWhitelist);
        SIGNUPS_ALLOWED="false";
        IP_HEADER="X-Forwarded-For";
      }; 
      environmentFile = config.sops.templates.vaultwardenEnvFile.path;
    };
    
  }); 
}