{ pkgs, lib, config, ... }:
let
  hostname = "matrix";
  fqdn = "${hostname}.cloonar.com";
  baseUrl = "https://${fqdn}";
  clientConfig."m.homeserver".base_url = baseUrl;
  serverConfig."m.server" = "${fqdn}:443";
  mkWellKnown = data: ''
    default_type application/json;
    add_header Access-Control-Allow-Origin *;
    return 200 '${builtins.toJSON data}';
  '';

  # Shared settings format for bridges
  settingsFormat = pkgs.formats.json {};
in {
  # Secrets for Synapse
  sops.secrets.synapse-oidc-client-secret = {
    owner = "matrix-synapse";
  };

  # PostgreSQL database for Synapse
  services.postgresql = {
    enable = true;
    ensureDatabases = [ "matrix-synapse" ];
    ensureUsers = [
      {
        name = "matrix-synapse";
        ensureDBOwnership = true;
      }
    ];
  };

  services.postgresqlBackup.enable = true;
  services.postgresqlBackup.databases = [ "matrix-synapse" ];

  # Synapse homeserver
  services.matrix-synapse = {
    enable = true;
    settings = {
      server_name = "cloonar.com";
      public_baseurl = baseUrl;

      listeners = [
        {
          port = 8008;
          bind_addresses = [ "::1" ];
          type = "http";
          tls = false;
          x_forwarded = true;
          resources = [
            {
              compress = true;
              names = [ "client" "federation" ];
            }
          ];
        }
      ];

      database = {
        name = "psycopg2";
        args = {
          host = "/run/postgresql";
          database = "matrix-synapse";
          user = "matrix-synapse";
        };
      };

      # Disable registration - users created via OIDC
      enable_registration = false;
      allow_guest_access = false;

      # OIDC SSO via Authelia
      oidc_providers = [
        {
          idp_id = "authelia";
          idp_name = "Authelia";
          discover = true;
          issuer = "https://auth.cloonar.com";
          user_profile_method = "userinfo_endpoint";
          client_id = "synapse";
          client_secret_path = config.sops.secrets.synapse-oidc-client-secret.path;
          scopes = [ "openid" "profile" "email" ];
          allow_existing_users = true;
          user_mapping_provider.config = {
            subject_claim = "sub";
            localpart_template = "{{ user.preferred_username }}";
            display_name_template = "{{ user.name }}";
            email_template = "{{ user.email }}";
          };
        }
      ];

      # Appservice registrations for bridges
      app_service_config_files = [
        "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml"
        "/var/lib/mautrix-signal/signal-registration.yaml"
        "/var/lib/mautrix-discord/discord-registration.yaml"
      ];
    };
  };

  # Allow bridge users to read registration files
  systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups = [
    "mautrix-whatsapp"
    "mautrix-signal"
    "mautrix-discord"
  ];

  # Element Web client
  services.nginx.virtualHosts."element.cloonar.com" = {
    forceSSL = true;
    enableACME = true;
    acmeRoot = null;
    root = pkgs.element-web.override {
      conf = {
        default_theme = "dark";
        default_server_config = {
          "m.homeserver" = {
            base_url = "https://matrix.cloonar.com";
            server_name = "cloonar.com";
          };
        };
        disable_custom_urls = true;
        disable_3pid_login = true;
        default_country_code = "AT";
      };
    };
  };

  # Synapse nginx reverse proxy
  services.nginx.virtualHosts."${fqdn}" = {
    forceSSL = true;
    enableACME = true;
    acmeRoot = null;
    locations."/".extraConfig = ''
      return 404;
    '';
    locations."/_matrix".proxyPass = "http://[::1]:8008";
    locations."/_synapse/client".proxyPass = "http://[::1]:8008";
  };

  #
  # Mautrix bridges
  #

  # WhatsApp bridge
  users.users.mautrix-whatsapp = {
    isSystemUser = true;
    group = "mautrix-whatsapp";
    home = "/var/lib/mautrix-whatsapp";
    description = "Mautrix-WhatsApp bridge user";
  };
  users.groups.mautrix-whatsapp = {};

  systemd.services.mautrix-whatsapp = let
    dataDir = "/var/lib/mautrix-whatsapp";
    registrationFile = "${dataDir}/whatsapp-registration.yaml";
    settingsFile = "${dataDir}/config.json";
    settingsFileUnsubstituted = settingsFormat.generate "mautrix-whatsapp-config-unsubstituted.json" defaultConfig;
    appservicePort = 29318;
    defaultConfig = {
      homeserver = {
        address = "http://[::1]:8008";
        domain = "cloonar.com";
      };
      appservice = {
        hostname = "[::]";
        port = appservicePort;
        database.type = "sqlite3";
        database.uri = "${dataDir}/mautrix-whatsapp.db";
        id = "whatsapp";
        bot.username = "whatsappbot";
        bot.displayname = "WhatsApp Bridge Bot";
        as_token = "";
        hs_token = "";
      };
      bridge = {
        username_template = "whatsapp_{{.}}";
        displayname_template = "{{if .BusinessName}}{{.BusinessName}}{{else if .PushName}}{{.PushName}}{{else}}{{.JID}}{{end}} (WA)";
        double_puppet_server_map = {};
        login_shared_secret_map = {};
        command_prefix = "!wa";
        permissions."*" = "relay";
        permissions."cloonar.com" = "user";
        relay.enabled = true;
        history_sync.request_full_sync = false;
        encryption = {
          allow = true;
          default = true;
          require = true;
        };
      };
      logging = {
        min_level = "info";
        writers = lib.singleton {
          type = "stdout";
          format = "pretty-colored";
          time_format = " ";
        };
      };
    };
  in {
    description = "Mautrix-WhatsApp Service - A WhatsApp bridge for Matrix";
    wantedBy = ["multi-user.target"];
    wants = ["network-online.target" "matrix-synapse.service"];
    after = ["network-online.target" "matrix-synapse.service"];

    preStart = ''
      test -f '${settingsFile}' && rm -f '${settingsFile}'
      old_umask=$(umask)
      umask 0177
      ${pkgs.envsubst}/bin/envsubst \
        -o '${settingsFile}' \
        -i '${settingsFileUnsubstituted}'
      umask $old_umask

      # generate the appservice's registration file if absent
      if [ ! -f '${registrationFile}' ]; then
        ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp \
          --generate-registration \
          --config='${settingsFile}' \
          --registration='${registrationFile}'
      fi
      chmod 640 ${registrationFile}

      umask 0177
      ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
        | .[0].appservice.hs_token = .[1].hs_token
        | .[0]' '${settingsFile}' '${registrationFile}' \
        > '${settingsFile}.tmp'
      mv '${settingsFile}.tmp' '${settingsFile}'
      umask $old_umask
    '';

    serviceConfig = {
      User = "mautrix-whatsapp";
      Group = "mautrix-whatsapp";
      StateDirectory = baseNameOf dataDir;
      WorkingDirectory = dataDir;
      ExecStart = ''
        ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp \
        --config='${settingsFile}' \
        --registration='${registrationFile}' \
        --ignore-unsupported-server
      '';
      LockPersonality = true;
      MemoryDenyWriteExecute = true;
      NoNewPrivileges = true;
      PrivateDevices = true;
      PrivateTmp = true;
      PrivateUsers = true;
      ProtectClock = true;
      ProtectControlGroups = true;
      ProtectHome = true;
      ProtectHostname = true;
      ProtectKernelLogs = true;
      ProtectKernelModules = true;
      ProtectKernelTunables = true;
      ProtectSystem = "strict";
      Restart = "on-failure";
      RestartSec = "30s";
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      SystemCallArchitectures = "native";
      SystemCallErrorNumber = "EPERM";
      SystemCallFilter = ["@system-service"];
      Type = "simple";
      UMask = 0027;
    };
    restartTriggers = [settingsFileUnsubstituted];
  };

  # Signal bridge
  users.users.mautrix-signal = {
    isSystemUser = true;
    group = "mautrix-signal";
    home = "/var/lib/mautrix-signal";
    description = "Mautrix-Signal bridge user";
  };
  users.groups.mautrix-signal = {};

  systemd.services.mautrix-signal = let
    pkgswithsignal = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/fd698a4ab779fb7fb95425f1b56974ba9c2fa16c.tar.gz") {
      config = {
        permittedInsecurePackages = [
          "olm-3.2.16"
        ];
      };
    };
    dataDir = "/var/lib/mautrix-signal";
    registrationFile = "${dataDir}/signal-registration.yaml";
    settingsFile = "${dataDir}/config.json";
    settingsFileUnsubstituted = settingsFormat.generate "mautrix-signal-config-unsubstituted.json" defaultConfig;
    appservicePort = 29328;
    defaultConfig = {
      homeserver = {
        address = "http://[::1]:8008";
        domain = "cloonar.com";
      };
      appservice = {
        hostname = "[::]";
        port = appservicePort;
        database.type = "sqlite3";
        database.uri = "file:${dataDir}/mautrix-signal.db?_txlock=immediate";
        id = "signal";
        bot = {
          username = "signalbot";
          displayname = "Signal Bridge Bot";
        };
        as_token = "";
        hs_token = "";
      };
      bridge = {
        username_template = "signal_{{.}}";
        displayname_template = "{{or .ProfileName .PhoneNumber \"Unknown user\"}} (Signal)";
        double_puppet_server_map = { };
        login_shared_secret_map = { };
        command_prefix = "!signal";
        permissions."*" = "relay";
        permissions."cloonar.com" = "user";
        relay.enabled = true;
        encryption = {
          allow = true;
          default = true;
          require = true;
        };
      };
      matrix = {
        sync_direct_chat_list = true;
      };
      logging = {
        min_level = "info";
        writers = lib.singleton {
          type = "stdout";
          format = "pretty-colored";
          time_format = " ";
        };
      };
    };
  in {
    description = "Mautrix-Signal Service - A Signal bridge for Matrix";
    wantedBy = ["multi-user.target"];
    wants = ["network-online.target" "matrix-synapse.service"];
    after = ["network-online.target" "matrix-synapse.service"];

    preStart = ''
      test -f '${settingsFile}' && rm -f '${settingsFile}'
      old_umask=$(umask)
      umask 0177
      ${pkgs.envsubst}/bin/envsubst \
        -o '${settingsFile}' \
        -i '${settingsFileUnsubstituted}'
      umask $old_umask

      # generate the appservice's registration file if absent
      if [ ! -f '${registrationFile}' ]; then
        ${pkgswithsignal.mautrix-signal}/bin/mautrix-signal \
          --generate-registration \
          --config='${settingsFile}' \
          --registration='${registrationFile}'
      fi
      chmod 640 ${registrationFile}

      umask 0177
      ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
        | .[0].appservice.hs_token = .[1].hs_token
        | .[0]
        | if env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET then .bridge.login_shared_secret_map.[.homeserver.domain] = env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET else . end' \
        '${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'
      mv '${settingsFile}.tmp' '${settingsFile}'
      umask $old_umask
    '';

    serviceConfig = {
      User = "mautrix-signal";
      Group = "mautrix-signal";
      StateDirectory = baseNameOf dataDir;
      WorkingDirectory = dataDir;
      ExecStart = ''
        ${pkgswithsignal.mautrix-signal}/bin/mautrix-signal \
        --config='${settingsFile}' \
        --registration='${registrationFile}' \
        --ignore-unsupported-server
      '';
      LockPersonality = true;
      MemoryDenyWriteExecute = true;
      NoNewPrivileges = true;
      PrivateDevices = true;
      PrivateTmp = true;
      PrivateUsers = true;
      ProtectClock = true;
      ProtectControlGroups = true;
      ProtectHome = true;
      ProtectHostname = true;
      ProtectKernelLogs = true;
      ProtectKernelModules = true;
      ProtectKernelTunables = true;
      ProtectSystem = "strict";
      Restart = "on-failure";
      RestartSec = "30s";
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      SystemCallArchitectures = "native";
      SystemCallErrorNumber = "EPERM";
      SystemCallFilter = ["@system-service"];
      Type = "simple";
      UMask = 0027;
    };
    restartTriggers = [settingsFileUnsubstituted];
  };

  # Discord bridge
  users.users.mautrix-discord = {
    isSystemUser = true;
    group = "mautrix-discord";
    home = "/var/lib/mautrix-discord";
    description = "Mautrix-Discord bridge user";
  };
  users.groups.mautrix-discord = {};

  systemd.services.mautrix-discord = let
    pkgswithdiscord = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/5ed627539ac84809c78b2dd6d26a5cebeb5ae269.tar.gz") {
      config = {
        permittedInsecurePackages = [
          "olm-3.2.16"
        ];
      };
    };
    dataDir = "/var/lib/mautrix-discord";
    registrationFile = "${dataDir}/discord-registration.yaml";
    settingsFile = "${dataDir}/config.json";
    settingsFileUnsubstituted = settingsFormat.generate "mautrix-discord-config-unsubstituted.json" defaultConfig;
    appservicePort = 29329;
    defaultConfig = {
      homeserver = {
        address = "http://[::1]:8008";
        domain = "cloonar.com";
      };
      appservice = {
        hostname = "[::]";
        port = appservicePort;
        database.type = "sqlite3";
        database.uri = "file:${dataDir}/mautrix-discord.db?_txlock=immediate";
        id = "discord";
        bot = {
          username = "discordbot";
          displayname = "Discord Bridge Bot";
        };
        as_token = "";
        hs_token = "";
      };
      bridge = {
        username_template = "discord_{{.}}";
        displayname_template = "{{or .GlobalName .Username}} (Discord{{if .Bot}} bot{{end}})";
        double_puppet_server_map = { };
        login_shared_secret_map = { };
        command_prefix = "!discord";
        permissions."*" = "relay";
        permissions."cloonar.com" = "user";
        relay.enabled = true;
        restricted_rooms = false;
        encryption = {
          allow = true;
          default = true;
          require = true;
        };
      };
      logging = {
        min_level = "info";
        writers = lib.singleton {
          type = "stdout";
          format = "pretty-colored";
          time_format = " ";
        };
      };
    };
  in {
    description = "Mautrix-Discord Service - A Discord bridge for Matrix";
    wantedBy = ["multi-user.target"];
    wants = ["network-online.target" "matrix-synapse.service"];
    after = ["network-online.target" "matrix-synapse.service"];

    preStart = ''
      test -f '${settingsFile}' && rm -f '${settingsFile}'
      old_umask=$(umask)
      umask 0177
      ${pkgs.envsubst}/bin/envsubst \
        -o '${settingsFile}' \
        -i '${settingsFileUnsubstituted}'
      umask $old_umask

      # generate the appservice's registration file if absent
      if [ ! -f '${registrationFile}' ]; then
        ${pkgswithdiscord.mautrix-discord}/bin/mautrix-discord \
          --generate-registration \
          --config='${settingsFile}' \
          --registration='${registrationFile}'
      fi
      chmod 640 ${registrationFile}

      umask 0177
      ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
        | .[0].appservice.hs_token = .[1].hs_token
        | .[0]
        | if env.MAUTRIX_DISCORD_BRIDGE_LOGIN_SHARED_SECRET then .bridge.login_shared_secret_map.[.homeserver.domain] = env.MAUTRIX_DISCORD_BRIDGE_LOGIN_SHARED_SECRET else . end' \
        '${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'
      mv '${settingsFile}.tmp' '${settingsFile}'
      umask $old_umask
    '';

    serviceConfig = {
      User = "mautrix-discord";
      Group = "mautrix-discord";
      StateDirectory = baseNameOf dataDir;
      WorkingDirectory = dataDir;
      ExecStart = ''
        ${pkgswithdiscord.mautrix-discord}/bin/mautrix-discord \
        --config='${settingsFile}' \
        --registration='${registrationFile}'
      '';
      LockPersonality = true;
      MemoryDenyWriteExecute = true;
      NoNewPrivileges = true;
      PrivateDevices = true;
      PrivateTmp = true;
      PrivateUsers = true;
      ProtectClock = true;
      ProtectControlGroups = true;
      ProtectHome = true;
      ProtectHostname = true;
      ProtectKernelLogs = true;
      ProtectKernelModules = true;
      ProtectKernelTunables = true;
      ProtectSystem = "strict";
      Restart = "on-failure";
      RestartSec = "30s";
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      SystemCallArchitectures = "native";
      SystemCallErrorNumber = "EPERM";
      SystemCallFilter = ["@system-service"];
      Type = "simple";
      UMask = 0027;
    };
    restartTriggers = [settingsFileUnsubstituted];
  };

}