{ pkgs, unstable-pkgs, ... }:
let
  watch-party = pkgs.callPackage ../../packages/watch-party.nix { };

  vhost = {
    forceSSL = true;
    enableACME = true;

    locations."/" = {
      proxyPass = "http://127.0.0.1:8524";
      proxyWebsockets = true;
      extraConfig = ''
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
      '';
    };
  };
in
{
  users.users.watch-party = {
    isSystemUser = true;
    group = "watch-party";
  };
  users.groups.watch-party = { };

  systemd.services.watch-party = {
    description = "watch-party";
    after = [ "network.target" ];
    wantedBy = [ "multi-user.target" ];

    environment = {
      BIND_HOST = "127.0.0.1";
      PORT = "8524";
      HOME = "/var/lib/watch-party";
    };

    serviceConfig = {
      Type = "simple";
      User = "watch-party";
      Group = "watch-party";
      StateDirectory = "watch-party";
      WorkingDirectory = "/var/lib/watch-party";
      ExecStartPre = [
        "${pkgs.coreutils}/bin/rm -rf app"
        "${pkgs.coreutils}/bin/cp -r ${watch-party}/share/watch-party app"
        "${pkgs.coreutils}/bin/chmod -R u+w app"
      ];
      ExecStart = "${unstable-pkgs.deno}/bin/deno task --cwd app start";
      Restart = "on-failure";
      RestartSec = "5s";

      NoNewPrivileges = true;
      PrivateTmp = true;
      ProtectSystem = "strict";
      ProtectHome = true;
    };
  };

  services.nginx.virtualHosts = {
    "watch.bun.how" = vhost;
    "staging.watch.bun.how" = vhost;
  };
}