{ config, pkgs, ... }:
let
  kanidm_listen_port = 5324;
in
{
  config = {
    services.caddy = {
      virtualHosts."http://auth.xinyang.life:80".extraConfig = ''
        reverse_proxy ${config.security.acme.certs."auth.xinyang.life".listenHTTP}
      '';
      virtualHosts."https://auth.xinyang.life".extraConfig = ''
        reverse_proxy https://127.0.0.1:${toString kanidm_listen_port} {
            header_up Host {upstream_hostport}
            header_down Access-Control-Allow-Origin "*"
            transport http {
                tls_server_name ${config.services.kanidm.serverSettings.domain}
            }
        }
      '';
    };

    services.kanidm = {
      package = pkgs.kanidm.withSecretProvisioning;
      enableServer = true;
      serverSettings = {
        domain = "auth.xinyang.life";
        origin = "https://auth.xinyang.life";
        bindaddress = "[::]:${toString kanidm_listen_port}";
        tls_key = ''${config.security.acme.certs."auth.xinyang.life".directory}/key.pem'';
        tls_chain = ''${config.security.acme.certs."auth.xinyang.life".directory}/fullchain.pem'';
        online_backup.versions = 7;
        # db_path = "/var/lib/kanidm/kanidm.db";
      };
      provision = import ./kanidm-provision.nix;
    };

    networking.firewall.allowedTCPPorts = [
      80
      443
    ];

    security.acme = {
      acceptTerms = true;
      certs."auth.xinyang.life" = {
        email = "lixinyang411@gmail.com";
        listenHTTP = "127.0.0.1:1360";
        group = "kanidm";
      };
    };

  };
}