# services/redlib.nix — Private Reddit front-end at reddit.nordhammer.it
{ config, lib, inputs, pkgs, ... }:
{
  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
    services.redlib = {
      enable = true;
      address = "127.0.0.1";
      port = 8087;

      # nixpkgs pins a Dec 2025 redlib that talks to Reddit over plain rustls.
      # Reddit fingerprints TLS and 403s every oauth.reddit.com call from it —
      # the token mints fine, then every API request fails. Upstream main
      # switched to wreq with Chrome/Firefox fingerprint emulation. Its own
      # flake is unusable (locked to Rust 1.82, older than wreq's edition2024),
      # so take the source from the input and build it with nixpkgs' toolchain.
      # Drop all of this once the wreq commit lands in the pinned channel.
      package = pkgs.rustPlatform.buildRustPackage {
        pname = "redlib";
        version = "0.36.0-unstable-2026-04-24";
        src = inputs.redlib;
        cargoLock.lockFile = "${inputs.redlib}/Cargo.lock";
        # boring-sys2 (wreq's TLS backend) builds BoringSSL from source
        # git: boring-sys2 patches BoringSSL in place before building it
        nativeBuildInputs = with pkgs; [ cmake perl go git rustPlatform.bindgenHook ];
        doCheck = false; # upstream tests hit the live Reddit API
      };
    };
  };
}