self: { config, lib, pkgs, ... }:
let
  cfg = config.services.wog;
  database = "/var/lib/wog/wog.sqlite3";
  hardening = {
    User = "wog";
    Group = "wog";
    StateDirectory = "wog";
    StateDirectoryMode = "0700";
    UMask = "0077";
    NoNewPrivileges = true;
    PrivateTmp = true;
    PrivateDevices = true;
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
  };
in
{
  options.services.wog = {
    enable = lib.mkEnableOption "World of Guildhall";
    package = lib.mkOption {
      type = lib.types.package;
      default = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
      defaultText = lib.literalExpression "wog.packages.${pkgs.stdenv.hostPlatform.system}.default";
      description = "The wog package to run.";
    };
    port = lib.mkOption {
      type = lib.types.port;
      default = 8100;
      description = "Loopback TCP port used by the game.";
    };
    userHeader = lib.mkOption {
      type = lib.types.str;
      default = "Remote-User";
      description = "Request header carrying the signed-in user, set by the authenticating proxy.";
    };
    backup = {
      directory = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = null;
        description = "Directory for nightly world snapshots; null disables backups.";
      };
      keep = lib.mkOption {
        type = lib.types.ints.positive;
        default = 30;
        description = "Number of nightly snapshots to keep.";
      };
    };
  };

  config = lib.mkIf cfg.enable (lib.mkMerge [
    {
      users.users.wog = {
        isSystemUser = true;
        group = "wog";
        description = "World of Guildhall service user";
      };
      users.groups.wog = { };

      systemd.services.wog = {
        description = "World of Guildhall";
        wantedBy = [ "multi-user.target" ];
        after = [ "network.target" ];
        serviceConfig = hardening // {
          ExecStart = "${cfg.package}/bin/wog --host 127.0.0.1 --port ${toString cfg.port} --db ${database} --user-header ${lib.escapeShellArg cfg.userHeader}";
          Restart = "on-failure";
          RestartSec = 3;
        };
      };
    }
    (lib.mkIf (cfg.backup.directory != null) {
      systemd.tmpfiles.rules = [ "d ${cfg.backup.directory} 0700 wog wog -" ];

      systemd.services.wog-backup = {
        description = "Snapshot World of Guildhall";
        unitConfig.RequiresMountsFor = [ cfg.backup.directory ];
        serviceConfig = hardening // {
          Type = "oneshot";
          ExecStart = "${cfg.package}/bin/wog --db ${database} --backup-to ${cfg.backup.directory} --keep ${toString cfg.backup.keep}";
          ReadWritePaths = [ cfg.backup.directory ];
        };
      };

      systemd.timers.wog-backup = {
        wantedBy = [ "timers.target" ];
        timerConfig = {
          OnCalendar = "*-*-* 03:25:00";
          Persistent = true;
        };
      };
    })
  ]);
}