{ pkgs, lib, config, ... }:
let
  domain = "matomo.cloonar.com";
  dataDir = "/var/www/${domain}";
in {
  systemd.services."phpfpm-${domain}".serviceConfig.ProtectHome = lib.mkForce false;

  services.phpfpm.pools."${domain}" = {
    user = domain;
    settings = {
      "listen.owner" = config.services.nginx.user;
      "pm" = "dynamic";
      "pm.max_children" = 32;
      "pm.max_requests" = 500;
      "pm.start_servers" = 2;
      "pm.min_spare_servers" = 2;
      "pm.max_spare_servers" = 5;
      "php_admin_value[error_log]" = "/var/log/$pool.php.error.log";
      "php_admin_flag[log_errors]" = true;
      "php_admin_value[display_errors]" = true;
      "catch_workers_output" = true;
      "access.log" = "/var/log/$pool.access.log";
    };
    phpPackage = pkgs.php81;
    phpEnv."PATH" = lib.makeBinPath [ pkgs.php81 ];
  };

  services.nginx.virtualHosts."${domain}" = {
    forceSSL = true;
    enableACME = true;
    acmeRoot = null;
    root = "${dataDir}";

    locations."/favicon.ico".extraConfig = ''
      log_not_found off;
      access_log off;
    '';

    locations."~* ^.+\\.php$".extraConfig = ''
      fastcgi_split_path_info ^(.+?\.php)(/.*)$;
      if (!-f $document_root$fastcgi_script_name) {
          return 404;
      }
      include ${pkgs.nginx}/conf/fastcgi_params;
      include ${pkgs.nginx}/conf/fastcgi.conf;
      fastcgi_buffer_size 32k;
      fastcgi_buffers 8 16k;
      fastcgi_connect_timeout 240s;
      fastcgi_read_timeout 240s;
      fastcgi_send_timeout 240s;
      fastcgi_pass unix:${config.services.phpfpm.pools."${domain}".socket};
      fastcgi_index        index.php;
    '';

    ## serve all other files normally
    locations."/".extraConfig = ''
      index index.php index.html;
      try_files $uri $uri/ /index.php$is_args$args;
    '';

    ## disable all access to the following directories
    locations."~ ^/(config|tmp|core|lang)".extraConfig = ''
      deny all;
      return 403; # replace with 404 to not show these directories exist
    '';

    locations."~ /\\.ht".extraConfig = ''
      deny  all;
      return 403;
    '';

    locations."~ js/container_.*_preview\\.js$".extraConfig = ''
      expires off;
      add_header Cache-Control 'private, no-cache, no-store';
    '';

    locations."~ \\.(gif|ico|jpg|png|svg|js|css|htm|html|mp3|mp4|wav|ogg|avi|ttf|eot|woff|woff2)$".extraConfig = ''
      allow all;
      ## Cache images,CSS,JS and webfonts for an hour
      ## Increasing the duration may improve the load-time, but may cause old files to show after an Matomo upgrade
      expires 1h;
      add_header Pragma public;
      add_header Cache-Control "public";
    '';

    locations."~ ^/(libs|vendor|plugins|misc|node_modules)".extraConfig = ''
      deny all;
      return 403;
    '';

    ## properly display textfiles in root directory
    locations."~/(.*\\.md|LEGALNOTICE|LICENSE)".extraConfig = ''
      default_type text/plain;
    '';

  };
  users.users."${domain}" = {
    isSystemUser = true;
    createHome = true;
    home = dataDir;
    homeMode= "770";
    #home = "/home/${domain}";
    group  = "nginx";
  };
  users.groups.${domain} = {};

  systemd.services."matomo-archive" = {
    startAt = "*-*-* 23:00:00";
    serviceConfig = {
      Type = "oneshot";
      User = "${domain}";
      ExecStart = "${pkgs.php81}/bin/php /var/www/${domain}/console --matomo-domain=matomo.cloonar.com core:archive";
    };
  };

  services.mysqlBackup.databases = [ "matomo" ];
}