{ pkgs, ... }:

let
  mysqlCreateDatabase = pkgs.writeShellScriptBin "mysql-create-database" ''
    #!/usr/bin/env bash
    if [ $# -lt 2 ]
    then
      echo "Usage: $0 <database> <host>"
      exit 1
    fi

    if ! [ $EUID -eq 0 ]
    then
      echo "Must be root!" >&2
      exit 1
    fi

    DB="$1"
    HOST="$2"
    PASSWORD="$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 64 | xargs)"

    cat <<EOF | mysql --host localhost --user root
    create database $DB;
    grant usage on $DB.* to '$DB'@'$HOST' identified by '$PASSWORD';
    grant all privileges on $DB.* to '$DB'@'$HOST';
    EOF

    echo
    echo "Password for user $DB is:"
    echo
    echo $PASSWORD
    echo
  '';
  mysqlDeleteDatabase = pkgs.writeShellScriptBin "mysql-delete-database" ''
    #!/usr/bin/env bash
    if [ $# -lt 1 ]
    then
      echo "Usage: $0 <database>"
      exit 1
    fi

    if ! [ $EUID -eq 0 ]
    then
      echo "Must be root!" >&2
      exit 1
    fi

    DB="$1"
    PASSWORD="$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 64 | xargs)"

    cat <<EOF | mysql --host localhost --user root
    drop database $DB;
    drop user '$DB';
    EOF

    echo
    echo "Dropped database $DB!"
    echo
  '';
in {
  environment.systemPackages = [
    mysqlCreateDatabase
    mysqlDeleteDatabase
  ];

  services.mysql = {
    enable = true;
    package = pkgs.mariadb;
    settings = {
      mysqld = {
        max_allowed_packet = "64M";
        transaction_isolation = "READ-COMMITTED";
        binlog_format = "ROW";
      };
    };
  };

  services.mysqlBackup.enable = true;
  services.mysqlBackup.databases = [ "mysql" ];
}