{ pkgs, lib, config, tranquil, ... }:
{
  services.bluesky-pds = {
    enable = true;
    settings = {
      PDS_HOSTNAME = "pds2.bun.how";
      PDS_PORT = 6280;

      PDS_INVITE_REQUIRED = "true";
      PDS_RATE_LIMITS_ENABLED = "false";

      PDS_BLOB_UPLOAD_LIMIT = "1073741824";

      PDS_DID_PLC_URL = "https://plc.directory";
      PDS_BSKY_APP_VIEW_URL = "https://api.pop1.bsky.app";
      PDS_BSKY_APP_VIEW_DID = "did:web:api.bsky.app";
      PDS_REPORT_SERVICE_URL = "https://mod.bsky.app";
      PDS_REPORT_SERVICE_DID = "did:plc:ar7c4by46qjdydhdevvrndac";
      PDS_CRAWLERS = "https://bsky.network";

    };
    environmentFiles = [ "/srv/pds/.env" ];
  };

  services.nginx.virtualHosts.${config.services.bluesky-pds.settings.PDS_HOSTNAME} = {
    forceSSL = true;
    enableACME = true;

    locations."/" = {
      proxyPass = "http://127.0.0.1:${toString config.services.bluesky-pds.settings.PDS_PORT}";
      proxyWebsockets = true;
      extraConfig = ''
        client_max_body_size 1G;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      '';
    };

    locations."= /".extraConfig = ''
      default_type text/plain;
      return 200 "pds2.bun.how";
    '';

    locations."/xrpc/app.bsky.ageassurance.getState".extraConfig = ''
      default_type application/json;
      add_header access-control-allow-headers $http_access_control_request_headers always;
      add_header access-control-allow-origin "*" always;
      return 200 '{"state":{"lastInitiatedAt":"2025-07-25T01:40:38.406Z","status":"assured","access":"full"},"metadata":{"accountCreatedAt":"2024-10-17T13:55:48.833Z"}}';
    '';
  };

  services.tranquil-pds = {
    enable = true;

    # `nix run nixpkgs#openssl -- rand -base64 48`
    # for JWT_SECRET, DPOP_SECRET, MASTER_KEY
    environmentFiles = [ "/srv/tranquil-pds/.env" ];
    database.createLocally = true;
    settings = {
      server = {
        host = "127.0.0.2";
        port = 6281;
        hostname = "pds3.bun.how";
        age_assurance_override = true;
      };
    };
  };

  services.nginx.virtualHosts.${config.services.tranquil-pds.settings.server.hostname} = {
    forceSSL = true;
    enableACME = true;

    locations."/" = {
      proxyPass = "http://${config.services.tranquil-pds.settings.server.host}:${toString config.services.tranquil-pds.settings.server.port}";
      proxyWebsockets = true;
      extraConfig = ''
        client_max_body_size 10G;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_hide_header Access-Control-Allow-Headers;
        proxy_hide_header Access-Control-Allow-Origin;
        add_header access-control-allow-headers $http_access_control_request_headers always;
        add_header access-control-allow-origin "*" always;
      '';
    };

    locations."/xrpc/app.bsky.ageassurance.getState".extraConfig = ''
      default_type application/json;
      add_header access-control-allow-headers $http_access_control_request_headers always;
      add_header access-control-allow-origin "*" always;
      return 200 '{"state":{"lastInitiatedAt":"2025-07-25T01:40:38.406Z","status":"assured","access":"full"},"metadata":{"accountCreatedAt":"2024-10-17T13:55:48.833Z"}}';
    '';
  };
}