{ pkgs, unstable-pkgs, ... }:
let
  serve-esm = pkgs.fetchFromGitHub {
    owner = "char";
    repo = "serve-esm";
    rev = "bcfd5aa20c4aa4619eaca06f8c917b21c204e129";
    hash = "sha256-ZnVpgszRMg/v9ZtK+IyKyRMcG5C+rXRnp5BeA6hF9eg=";
  };
in
{
  users.users.serve-esm = {
    isSystemUser = true;
    group = "serve-esm";
    home = "/var/lib/serve-esm";
  };
  users.groups.serve-esm = { };

  systemd.services.serve-esm = {
    description = "serve-esm";
    after = [ "network.target" ];
    wantedBy = [ "multi-user.target" ];
    path = [ pkgs.git ];
    unitConfig.ConditionPathIsDirectory = "/srv/apps/serve-esm/repositories/citrus/.git";

    environment = {
      HOME = "/var/lib/serve-esm";
      TARGET_DIR = "/srv/apps/serve-esm/repositories";
    };

    serviceConfig = {
      Type = "simple";
      User = "serve-esm";
      Group = "serve-esm";
      StateDirectory = "serve-esm";
      WorkingDirectory = "${serve-esm}";
      ExecStart = "${unstable-pkgs.deno}/bin/deno serve --host 127.0.0.1 --port 8525 --allow-env=TARGET_DIR --allow-read --allow-run=git ${serve-esm}/src/main.ts";
      Restart = "on-failure";
      RestartSec = "5s";

      NoNewPrivileges = true;
      PrivateTmp = true;
      ProtectSystem = "strict";
      ProtectHome = true;
    };
  };

  systemd.tmpfiles.rules = [
    "d /srv/apps/serve-esm 0755 serve-esm serve-esm - -"
    "d /srv/apps/serve-esm/repositories 0755 serve-esm serve-esm - -"
    "d /var/cache/nginx/serve-esm 0750 nginx nginx - -"
  ];

  services.nginx = {
    proxyCachePath.serve-esm = {
      enable = true;
      keysZoneName = "serve_esm";
      keysZoneSize = "32m";
      maxSize = "4g";
      inactive = "30d";
    };

    virtualHosts."esm.char.lt" = {
      forceSSL = true;
      enableACME = true;

      locations."/" = {
        proxyPass = "http://127.0.0.1:8525";
        extraConfig = ''
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;

          proxy_cache serve_esm;
          proxy_cache_key $request_uri;
          proxy_cache_valid 200 301 302 30d;
          proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
          proxy_cache_background_update on;
          proxy_cache_lock on;
          proxy_cache_revalidate on;
          add_header X-Cache-Status $upstream_cache_status;
        '';
      };
    };
  };
}