{ config, ... }:
let
  inherit (import ../lib.nix config) blazestar;
  db_password = "wargame-vods/db/password";
  admin_token = "wargame-vods/admin-token";
  youtube_api_key = "wargame-vods/youtube-api-key";
in
{
  sops = {
    secrets = {
      "${db_password}" = { };
      "${admin_token}" = { };
      "${youtube_api_key}" = { };
    };
    templates."wargame-vods.env" = {
      mode = "0400";
      content = ''
        ADMIN_TOKEN=${config.sops.placeholder."${admin_token}"}
        PGHOST=db
        PGPORT=5432
        PGUSER=wargame-vods
        PGPASS=${config.sops.placeholder."${db_password}"}
        PGDATABASE=wargame-vods
        STATIC_DIR=/app/static
        PORT=8081
        SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
        CORS_ORIGINS=https://vods.blazestar.net
        YOUTUBE_API_KEY=${config.sops.placeholder."${youtube_api_key}"}
      '';
      restartUnits = [ "podman-wargame-vods.service" ];
    };
  };
  virtualisation.web-containers.containers.wargame-vods = {
    image = "docker.havenisms.com/apps/wargame-vods";
    hostname = "vods";
    domain = blazestar;
    port = 8081;
    public = true;
    volumes = [ ];
    dependsOn = [ "db" ];
    environmentFiles = [
      config.sops.templates."wargame-vods.env".path
    ];
  };

  systemd = {
    timers.wargame-vods-import = {
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnCalendar = "hourly";
        Persistent = false; # Do not catch up if timers were missed
        RandomizedDelaySec = "5m"; # Jitter so it doesn't get synced up with anything else.
      };
    };
    services.wargame-vods-import = {
      description = "Hourly wargame-vods import";
      serviceConfig = {
        Type = "oneshot";
        ExecStart = "${config.local.container-bin}/bin/docker exec wargame-vods /proc/1/exe sync";
      };
    };
  };
}