{ config, pkgs, lib, ... }:

{
  # Invidious - Privacy-focused YouTube frontend
  # Replaces Piped with native NixOS service

  # Main Invidious service
  services.invidious = {
    enable = true;
    domain = "invidious.cloonar.com";
    port = 3000;

    # PostgreSQL database configuration
    database = {
      createLocally = true;
    };

    # Enable nginx reverse proxy with automatic TLS
    nginx.enable = true;

    # Signature helper disabled - crashes with current YouTube player patterns
    # Re-enable once inv-sig-helper is updated to handle new YouTube obfuscation
    # sig-helper = {
    #   enable = true;
    # };

    # Service settings
    settings = {
      # Disable registration - admin user created via init script
      registration_enabled = false;

      # Disable CAPTCHA (not needed for private instance)
      captcha_enabled = false;

      # Database configuration
      check_tables = true;
      db = {
        user = "invidious";
        dbname = "invidious";
      };

      # Optional: Instance customization
      default_home = "Popular";
      feed_menu = [ "Popular" "Trending" "Subscriptions" ];
    };
  };

  # Override nginx vhost configuration
  services.nginx.virtualHosts."invidious.cloonar.com" = {
    acmeRoot = null;
  };

  # Firewall configuration for Invidious
  # (nginx handles external access on ports 80/443)

  # PostgreSQL backup for Invidious database
  services.postgresqlBackup = {
    databases = [ "invidious" ];
  };
}