{ lib, config, pkgs, ... }:
let cfg = config.services.tsrevprox;
in {
  options = with lib; {
    services.tsrevprox = {
      enable = lib.mkEnableOption "Enable tsrevprox";

      reversePort = mkOption {
        type = types.int;
        default = 5000;
        description = ''
          Port to forward connections to.
        '';
      };

      reverseIP = mkOption {
        type = types.str;
        default = "127.0.0.1";
        description = ''
          IP to forward connections to.
        '';
      };

      reverseName = mkOption {
        type = types.str;
        default = "tsrevprox";
        description = ''
          Name used in for the front facing http server (will be a tailscale name).
        '';
      };

      user = mkOption {
        type = with types; oneOf [ str int ];
        default = "tsrevprox";
        description = ''
          The user the service will use.
        '';
      };

      group = mkOption {
        type = with types; oneOf [ str int ];
        default = "tsrevprox";
        description = ''
          The group the service will use.
        '';
      };

      dataDir = mkOption {
        type = types.path;
        default = "/var/lib/tsrevprox";
        description = "Path tsrevprox home directory";
      };

      package = mkOption {
        type = types.package;
        default = pkgs.ts-reverse-proxy;
        defaultText = literalExpression "pkgs.ts-reverse-proxy";
        description = "The package to use for ts-reverse-proxy";
      };

      envFile = mkOption {
        type = types.path;
        default = "/run/secrets/ts_proxy_env";
        description = ''
          Path to a file containing the ts-reverse-proxy token information
        '';
      };
    };
  };

  config = lib.mkIf cfg.enable {
    users.groups.${cfg.group} = { };
    users.users.${cfg.user} = {
      description = "tsrevprox service user";
      isSystemUser = true;
      home = "${cfg.dataDir}";
      createHome = true;
      group = "${cfg.group}";
    };

    systemd.services.tsrevprox = {
      enable = true;
      description = "tsrevprox server";
      wantedBy = [ "network-online.target" ];
      after = [ "network-online.target" ];

      environment = { HOME = "${cfg.dataDir}"; };

      serviceConfig = {
        User = cfg.user;
        Group = cfg.group;

        ExecStart =
          "${cfg.package}/bin/ts-reverse-proxy -name ${cfg.reverseName} -port ${
            toString cfg.reversePort
          } -ip ${cfg.reverseIP}";
        EnvironmentFile = cfg.envFile;
      };
    };
  };
}