{ config, pkgs, ... }:
let
  domain = "opia.ovh";
  subdomain = "cal";
in
{
  age.secrets.lauti.file = ../../../secrets/lauti.age;

  services.lauti = {
    enable = true;
    settings = {
      LAUTI_ADDR = "localhost:3333";
      LAUTI_MAIL_ADDRESS = "lauti@${domain}";
      LAUTI_ADMIN_EMAIL = "lauti@${domain}";
      LAUTI_TIMEZONE = config.time.timeZone;
      LAUTI_BASE_URL = "https://${subdomain}.${domain}";
      # LAUTI_ADMIN_PASSWORD = in secret
    };
    secrets = [ config.age.secrets.lauti.path ];
  };
  # for debugging the database
  environment.systemPackages = with pkgs; [ litecli ];

  services.caddy = {
    virtualHosts."${subdomain}.${domain}" = {
      extraConfig = ''
        tls {
          dns_challenge_override_domain _acme-challenge.${subdomain}.opia.${config.networking.domain}
        }
        encode zstd gzip

        reverse_proxy ${config.services.lauti.settings.LAUTI_ADDR} {
          header_up -Accept-Encoding
          transport http {
            compression off
          }
        }
      '';
    };
  };
}