{ config, ... }:
let
  inherit (import ./lib.nix config) mkContainer blazestar;
  # The default is to run on port 80, which the pocket-id user cannot bind to.
  # We need a different port to be able to serve traffic.
  # The following ports in the container are already taken:
  # - 8080: API
  # - 3000: Web UI
  # - 2019: Admin endpoint
  port = 8888;
  encryption_key = "pocket-id/encryption_key";
in
{

  sops.secrets = {
    "${encryption_key}" = {
      restartUnits = [ "${config.local.container-backend}-pocket-id.service" ];
      mode = "0400";
      owner = "pocket-id";
    };
  };

  sops.templates."pocket-id.env" = {
    content = ''
      ENCRYPTION_KEY=${config.sops.placeholder."${encryption_key}"}
    '';
    owner = "pocket-id";
  };

  virtualisation.oci-containers.containers.pocket-id = mkContainer {
    image = "ghcr.io/pocket-id/pocket-id";
    dependsOn = [ ];
    hostName = "auth";
    port = port;
    public = false;
    domain = blazestar;
    homepageOpts = {
      group = "Infra";
      name = "Pocket ID";
      icon = "pocket-id";
      description = "Pocket ID Auth Server";
    };
    volumes = [
      "/tank/pocket-id/data:/app/data"
    ];
    environment = {
      APP_URL = "https://auth.${blazestar}";
      # Whether the app is behind a reverse proxy.
      TRUST_PROXY = "true";
      PORT = toString port;
      # PORT = "3000"; # Frontend port
      # BACKEND_PORT = "8080"; # Backend port
      PUID = toString config.users.users."pocket-id".uid;
      PGID = toString config.users.groups."pocket-id".gid;
    };
    environmentFiles = [
      config.sops.templates."pocket-id.env".path
    ];
  };
}