{ config, pkgs, inputs, lib, ... }:
let
	domain = "thehellings.com";
	fqdn = "matrix.${domain}";
	conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
in
{
	containers.matrix = {
		autoStart = true;
		bindMounts."/etc/ssh".hostPath = "/etc/ssh";
		config = { pkgs, config, ... }: {
			imports = [
				inputs.agenix.nixosModules.default
				inputs.self.modules.nixosModule
			];

			nixpkgs.overlays = inputs.self.overlays.all;

			networking = {
				firewall = {
					enable = true;
					allowedTCPPorts = [ config.services.dendrite.httpPort ];
				};
				useHostResolvConf = lib.mkForce false;
			};

			# Environment secrets
			age = {
				identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
				secrets.dendrite = {
					file = ../../secrets/dendrite.age;
					owner = "dendrite";
				};
			};

			users.users.dendrite = {
				isSystemUser = true;
				group = "dendrite";
			};
			users.groups.dendrite = {};

			systemd.services.dendrite.serviceConfig = {
				User = "dendrite";
			};

			greg = {
				databases.dendrite = {};
				tailscale.enable = true;
			};

			services.dendrite = {
				enable = true;
				environmentFile = config.age.secrets.dendrite.path;
				httpPort = 8448;
				# Identify ourselves as the root of our own domain
				settings = (
				(builtins.listToAttrs (
					(map (x: { name = x; value = { database.connection_string = conn; }; }) [
						"app_service_api"
						"federation_api"
						"key_server"
						"media_api"
						"mscs"
						"relay_api"
						"room_server"
						"sync_api"
					])
				) ) //
				{
					user_api.account_database.connection_string = conn;
					user_api.device_database.connection_string = conn;
					global = {
						database = {
							connection_string = conn;
							max_open_conns = 25;
							max_idle_conns = 5;
							conn_max_lifetime = -1;
						};
						server_name = "thehellings.com";
						trusted_third_party_id_servers = [
							"matrix.org"
							"vector.im"
							"jupiterbroadcasting.com"
						];
						# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
						private_key = "/etc/dendrite.pem";
					};
					client_api = {
						registration_enabled = false;
						registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
					};
				});
			};

			systemd.services.dendrite = {
				after = [ "postgresql.service" ];
				requires = [ "postgresql.service" ];
			};
		};
	};
}