{ config, pkgs, ... }:

{
  sops.secrets.plausible-admin-password = {
    sopsFile = ./secrets.yaml;
  };
  sops.secrets.plausible-secret = {
    sopsFile = ./secrets.yaml;
  };

  services.plausible = {
    enable = true;
    releaseCookiePath = "/run/secrets/plausible-release-cookie";
    server = {
      secretKeybaseFile = config.sops.secrets.plausible-secret.path;
      baseUrl = "plausible.cloonar.com";
    };
    database.clickhouse = {
      setup = false;
    };
    database.postgres = {
      dbname = "plausible";
    };
    adminUser = {
      activate = true;
      email = "plausible@cloonar.com";
      passwordFile = config.sops.secrets.plausible-admin-password.path;
    };
  };

  services.nginx.enable = true;
  services.nginx.virtualHosts."plausible.cloonar.com" = {
    forceSSL = true;
    enableACME = true;
    acmeRoot = null;
    locations."/" = {
      proxyPass = "http://localhost:8000";
    };
  };

  services.postgresqlBackup.databases = [ "plausible" ];
}