{ config, lib, pkgs, ...}:
let
  cfg = config.services.miniflux;

  # this is supposed to be used on localhost (in a container) only. The access
  # to the database is only possible from miniflux or whatever else the admin
  # decides to put in the same container..
  dbUser = "miniflux";
  dbPassword = "miniflux";
  dbHost = "localhost";
  dbName = "miniflux";
  pgSuperUser = config.services.postgresql.superUser;
in {
  options = with lib; {
    services.miniflux = {
      enable = mkEnableOption "miniflux";

      package = mkOption {
        type = types.package;
        example = "miniflux";
      };

      user = mkOption {
        type = types.str;
        default = "miniflux";
        example = "miniflux";
        description = ''
          User account the daemon will run under.
        '';
      };

      listenAddress = mkOption {
        type = types.str;
        default = "localhost";
        description = ''
          The host the daemon will listen on.
        '';
      };

      listenPort = mkOption  {
        type = types.int;
        default = 8080;
        example = "8080";
        description = ''
          The port the daemon will listen on.
        '';
      };

      extraConfig = mkOption {
        type = types.lines;
        default = "";
        example = ''
          CREATE_ADMIN=1
          ADMIN_USERNAME=clown
          ADMIN_PASSWORD=s3cret123
        '';
      };

      statePath = mkOption {
        type = types.str;
        default = "/var/miniflux/state";
        description = "miniflux state directory.";
      };
    };
  };

  config = lib.mkIf cfg.enable {
    services.postgresql.enable = lib.mkDefault true;
    users.users."${cfg.user}" = {
      createHome = false;
    };
    systemd.services.miniflux = let
      configFile = pkgs.writeText "miniflux.conf" ''
        RUN_MIGRATIONS=1
        LISTEN_ADDR=${cfg.listenAddress}:${builtins.toString cfg.listenPort}
        DATABASE_URL="postgresql://${dbUser}:${dbPassword}@${dbHost}/${dbName}?sslmode=disable"
        ${cfg.extraConfig}
      '';
    in {
      description = "Miniflux service";
      preStart = ''
        mkdir -p ${cfg.statePath}
        if ! test -e "${cfg.statePath}/db-created"; then
          ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} ${config.services.postgresql.package}/bin/psql postgres -c "CREATE ROLE ${dbUser} WITH LOGIN NOCREATEDB NOCREATEROLE ENCRYPTED PASSWORD '${dbPassword}'"
          ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} ${config.services.postgresql.package}/bin/createdb --owner ${dbUser} ${dbName}
          ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} ${config.services.postgresql.package}/bin/psql ${dbName} -c "CREATE EXTENSION IF NOT EXISTS hstore"
        #  source ${configFile}
        #  ${pkgs.sudo}/bin/sudo -u ${cfg.user} ${cfg.package}/bin/miniflux -migrate
          touch ${cfg.statePath}/db-created
        fi
      '';
      serviceConfig = {
        PermissionsStartOnly = true;
        Type = "simple";
        EnvironmentFile = configFile;
        PrivateTmp = false;
        ExecStart = "${cfg.package}/bin/miniflux.app";
        User = cfg.user;
      };
    };
  };
}