{ config, lib, pkgs, ... }:
let
  domain = "irc.t4t.associates";
  cert = config.security.acme.certs.${domain};
in
{
  security.acme.certs.${domain} = {
    server = "https://dv.acme-v02.api.pki.goog/directory";
    extraLegoFlags = [ "--eab" ];
    environmentFile = "/var/lib/secrets/google-acme.env";
    group = "irc-certs";
    reloadServices = [ "ergochat.service" ];
  };

  services.nginx.virtualHosts.${domain} = {
    enableACME = true;
    locations."/".return = "404";
  };

  users.groups.irc-certs.members = [ "nginx" ];

  services.ergochat = {
    enable = true;
    settings = {
      allow-environment-overrides = true;
      network.name = "t4t.associates";
      server = {
        name = domain;
        # The module otherwise retains its default plaintext listener.
        listeners = lib.mkForce {
          "127.0.0.1:16697" = {
            proxy = true;
            tls = {
              cert = "${cert.directory}/fullchain.pem";
              key = "${cert.directory}/key.pem";
            };
          };
        };
        proxy-allowed-from = [ "127.0.0.1/32" ];
      };
      accounts = {
        registration = {
          enabled = true;
          allow-before-connect = true;
        };
        require-sasl.enabled = false;
      };
      api = {
        enabled = true;
        listener = "127.0.0.1:8089";
      };
      logging = [
        {
          method = "stdout";
          type = "* -userinput -useroutput";
          level = "info";
        }
      ];
    };
  };

  systemd.services.ergochat = {
    requires = [ "acme-${domain}.service" ];
    after = [ "acme-${domain}.service" ];
    serviceConfig = {
      # Ergo's reload notification lacks MONOTONIC_USEC, required by notify-reload.
      Type = lib.mkForce "notify";
      ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
      EnvironmentFile = "/var/lib/secrets/ergo.env";
      SupplementaryGroups = [ "irc-certs" ];
      StateDirectoryMode = "0700";
      Restart = "on-failure";
      RestartSec = "5s";
    };
  };
}