{ config, pkgs, lib, host, hostName, ... }:
let
  inherit (config.networking) domain;
  inherit (config.users) users;
  srv = "radicle";
  radicle = config.services.radicle;
  seed = "${srv}-${hostName}.${domain}";
in
{
  services.radicle = {
    enable = true;
    privateKeyFile = "key:${radicle/key.cred}";
    publicKeyFile = radicle/key.pub;
    #package = pkgs.radicle-node;
    node = { };
    # FIXME: because radicle-node from the heartwood's flake.nix does not include rad
    # Should be re-enabled once radicle-node comes from Nixpkgs
    checkConfig = false;
    httpd = {
      enable = true;
      package = pkgs.radicle-httpd;
      nginx = {
        serverName = seed;
        forceSSL = true;
        enableACME = false;
        useACMEHost = domain;
        extraConfig = ''
          access_log off;
          error_log  /var/log/nginx/${domain}/${srv}-${hostName}/error.log warn;
        '';
      };
    };
    settings = {
      preferredSeeds = [
        "z6MkrLMMsiPWUcNPHcRajuMi9mDfYckSoJyPwwnknocNYPm7@seed.radicle.garden:8776"
        #"z6Mkmqogy2qEM2ummccUthFEaaHvyYmYBYh3dbe9W4ebScxo@ash.radicle.garden:8776"
      ];
      publicExplorer = "https://${srv}.${domain}/nodes/$host/$rid$path";
      node = {
        policy = "block";
        scope = "all";
        # Relaying produces a constant network stream!
        relay = "never";
        # Make this a public node
        #externalAddresses = [
        #  "${seed}:${toString radicle.node.listenPort}"
        #  #"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.onion:${toString radicle.node.listenPort}"
        #];
        peers = {
          type = "dynamic";
          target = 0;
        };
        limits = {
          routingMaxSize = 1000;
          routingMaxAge = 1 * 7 * 24 * 60 * 60; # 1 week
          gossipMaxAge = 1 * 7 * 24 * 60 * 60; # 1 week
          fetchConcurrency = 1;
          maxOpenFiles = 4096;
          rate = {
            inbound = {
              fillRate = 1;
              capacity = 1;
            };
            outbound = {
              fillRate = 1;
              capacity = 1;
            };
          };
          connection = {
            inbound = 16;
            outbound = 8;
          };
        };
        workers = host.CPUs;
        /*
        onion = {
          mode = "proxy";
          address = "127.0.0.1:9050";
        };
        */
      };
      web = {
        pinned = {
          # Pinned repositories must be `rad clone`-d before.
          repositories = [
            "rad:z2364hmzZUAGy1nKdSFa1gLSoUE2M" # literate-phylomemy
            "rad:z3795BqJN8hSMGkyAUr8hHviEEi2H" # logic
            "rad:z4NtwMC1GmUuCRLngaZrVrSZLmUvh" # symantic-base
          ];
        };
      };
    };
  };
  systemd.services.radicle-node = {
    environment.RUST_LOG = "debug";
    serviceConfig = {
      CPUAccounting = true;
      CPUWeight = "idle";
      #CPUQuota = "60%";
      MemoryAccounting = true;
      MemoryHigh = "500M";
      MemoryMax = "600M";
      CPUSchedulingPolicy = "idle";
      IOSchedulingClass = "idle";
      # 0: high priority, 7: low priority
      IOSchedulingPriority = 3;
      Nice = 15;
    };
  };
  services.sanoid.datasets."rpool/var/lib/${srv}" = {
    use_template = [ "snap" ];
    hourly = 0;
    daily = 7;
    monthly = 0;
    recursive = true;
  };
  environment.systemPackages = [
    pkgs.radicle-node
  ];

  networking.nftables.ruleset = ''
    table inet filter {
      chain input-net {
        tcp dport ${toString radicle.node.listenPort} counter accept comment "radicle-node"
      }
      chain input-neb-sourcephile {
        tcp dport ${toString radicle.node.listenPort} counter accept comment "radicle-node"
      }
      chain output-net {
        skuid ${users.radicle.name} meta l4proto tcp counter accept comment "radicle-node"
      }
    }
  '';

  services.nginx.virtualHosts."${srv}-explorer.${domain}" = {
    serverAliases = [ "${srv}.${domain}" ];
    forceSSL = true;
    useACMEHost = domain;
    extraConfig = ''
      access_log off;
      error_log  /var/log/nginx/${domain}/${srv}-explorer/error.log warn;
    '';
    locations."/" = {
      extraConfig = ''
        try_files $uri $uri/ /index.html;
      '';
      index = "index.html";
      root = pkgs.radicle-explorer.overrideAttrs (previousAttrs: {
        postPatch = (previousAttrs.postPatch or "") + ''
          cp ${pkgs.writeText "local.json" ''
            {
              "nodes": {
                "fallbackPublicExplorer": "https://app.radicle.xyz/nodes/$host/$rid$path",
                "defaultHttpdPort": 443,
                "defaultLocalHttpdPort": 8080,
                "defaultHttpdHostname": "localhost",
                "defaultHttpdScheme": "https",
                "defaultNodePort": 8776,
                "pinned": [
                  {
                    "baseUrl": {
                      "hostname": "${seed}",
                      "port": 443,
                      "scheme": "https"
                    }
                  }
                ]
              },
              "supportWebsite": "https://radicle.zulipchat.com",
              "reactions": ["👍", "👎", "😄", "🙁", "👀"],
              "fallbackPreferredSeed": {
                "hostname": "${seed}",
                "port": 443,
                "scheme": "https"
              }
            }
          ''} config/local.json
        '';
      });
    };
  };
  systemd.services.nginx.serviceConfig.LogsDirectory = lib.mkForce [
    "nginx/${domain}/${srv}-${hostName}"
    "nginx/${domain}/${srv}-explorer"
  ];

}