{ config, ... }:
let
  domain = "soju.char.lt";
  cert = config.security.acme.certs.${domain};
in
{
  services.nginx.virtualHosts.${domain} = {
    enableACME = true;
    locations."/".return = "404";
  };

  # soju expects PROXY headers inside TLS, so terminate TLS before forwarding.
  services.nginx.streamConfig = ''
    server {
      listen 127.0.0.1:16698 ssl proxy_protocol;
      set_real_ip_from 127.0.0.1;
      ssl_certificate ${cert.directory}/fullchain.pem;
      ssl_certificate_key ${cert.directory}/key.pem;
      ssl_protocols TLSv1.2 TLSv1.3;
      proxy_pass 127.0.0.1:16699;
      proxy_protocol on;
      proxy_timeout 1h;
    }
  '';

  services.soju = {
    enable = true;
    hostName = domain;
    listen = [ "irc+insecure://127.0.0.1:16699" ];
    acceptProxyIP = [ "127.0.0.1/32" ];
  };

  systemd.services.soju.serviceConfig = {
    StateDirectoryMode = "0700";
    RuntimeDirectoryMode = "0700";
  };
}