{ config, pkgs, lib, ... }:

with lib;

{
  services.nginx.enable = true;

  services.nginx.virtualHosts = mkMerge [
    (mkIf config.sVAULTWARDEN.enable {
      "${config.HostName}-vault" = {
        listen = [{ addr = "0.0.0.0"; port = config.sVAULTWARDEN.externalPort; }];
        locations."/" = {
          proxyPass = "http://127.0.0.1:${toString config.sVAULTWARDEN.internalPort}";
          extraConfig = ''
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
          '';
        };
      };
    })

    (mkIf config.sROUNDCUBE.enable {
      "${config.HostName}-roundcube" = {
        listen = [{ addr = "0.0.0.0"; port = config.sROUNDCUBE.port; }];
        root = "${pkgs.roundcube}/public_html";
        locations."/" = {
          extraConfig = ''
            index index.php index.html;
            try_files $uri $uri/ /index.php?$args;
          '';
        };
        locations."~ \\.php$" = {
          extraConfig = ''
            include ${pkgs.nginx}/conf/fastcgi_params;
            fastcgi_pass unix:/run/phpfpm/roundcube.sock;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
          '';
        };
      };
    })
  ];

  networking.firewall.allowedTCPPorts = concatLists [
    (if config.sVAULTWARDEN.enable then [ config.sVAULTWARDEN.externalPort ] else [])
    (if config.sROUNDCUBE.enable   then [ config.sROUNDCUBE.port   ] else [])
  ];
}