{ config, pkgs, lib, inputs,  ... }:
  with lib;
  let
    cfg = config.services.ldap_backend;
    port_backend = "8087";
  in {

  imports = [
    ../acme.nix
    ../dns.nix
    ../nginx.nix
    inputs.skynet_ldap_backend.nixosModule."x86_64-linux"
  ];

  options.services.ldap_backend = {
    enable = mkEnableOption "Skynet LDAP backend server";

    host = {
      ip = mkOption {
        type = types.str;
      };

      name = mkOption {
        type = types.str;
      };
    };

    domain = {
      tld = mkOption {
        type = types.str;
        default = "ie";
      };

      base = mkOption {
        type = types.str;
        default = "skynet";
      };

      sub = mkOption {
        type = types.str;
        default = "api.account";
      };
    };
  };

  config = mkIf cfg.enable {

    #backups = [ "/etc/silver_ul_ical/database.db" ];

    age.secrets.ldap_details.file = ../../secrets/ldap/details.age;
    age.secrets.ldap_discord.file = ../../secrets/discord/ldap.age;
    age.secrets.ldap_mail.file = ../../secrets/email/details.age;

    skynet_acme.domains = [
      "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}"
    ];

    skynet_dns.records = [
      {record=cfg.domain.sub; r_type="CNAME"; value=cfg.host.name;}
    ];

    services.nginx.virtualHosts."${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = {
      forceSSL = true;
      useACMEHost = "skynet";
      locations."/".proxyPass = "http://localhost:${port_backend}";

#      extraConfig = ''
#        add_header Access-Control-Allow-Origin "https://account.${cfg.domain.base}.${cfg.domain.tld}";
#      '';
      extraConfig = ''
        add_header Access-Control-Allow-Origin "*";
      '';
    };

    services.skynet_ldap_backend = {
      enable = true;

      # contains teh password in env form
      env = {
        ldap = config.age.secrets.ldap_details.path;
        discord = config.age.secrets.ldap_discord.path;
        mail = config.age.secrets.ldap_mail.path;
      };

      host_port = "127.0.0.1:${port_backend}";

      users = {
        admin = [
          "silver"
          "evanc"
          "eoghanconlon73"
        ];
        committee = [
          "grym"
          "dawidk5"
          "leo"
          "silver"
          "eoghanconlon73"
        ];
        lifetime = [];
        banned = [];
        restricted = [
          # usernames folks arent allowed to use
          "contact"
          "dnsadm"
          "president"
          "treasurer"
          "secretary"
          "pro"
          "sysadmin"
          "root"

          ] ++ [
          # basis comes from https://discord.com/channels/689189992417067052/1126084496710713414/1149072061466169444
          # start off with compsoc stuff first
          "competition_www"
          "demo1"
          "demouser"
          "ftp"
          "lost+found"
          "postfix"
          "skynews.old"
          "system_backup"
          "test"
          "test12"
          "test20202"
          "test20203"
          "tmp"
          "webadm"
        ] ++ [
          # clubs and socs (as far as I can tell
          "aerosoc"
          "aikido"
          "anfocal"
          "bics"
          "boarding"
          "cns"
          "dev"
          "filmsoc"
          "gaa"
          "german"
          "golfsoc"
          "handball"
          "hispanic"
          "history"
          "hockey"
          "home"
          "legosoc"
          "lifesave"
          "mens_gfc"
          "musicsoc"
          "pagansoc"
          "peacesoc"
          "physics"
          "poker"
          "prolife"
          "radio"
          "ragweek"
          "sinnfein"
          "soccer"
          "ulbs"
          "ulcamogie"
          "ulcc"
          "ulgaa"
          "ulils"
          "ulladiesfootball"
          "ullaughinsoc"
          "ulrfc"
          "ulriders"
          "ulssc"
          "ultennis"
          "viking"
        ] ++ [
          # remaining, most likely usernames
          "_9thwonder"
          "abc"
          "activate"
          "aiesec"
          "air"
          "aladdin"
          "alaric"
          "aldozzie"
          "allenli"
          "amg"
          "amgl"
          "annette"
          "annlad"
          "ards_backup"
          "arisquez"
          "arthur"
          "austin"
          "beta"
          "bh"
          "bigdave"
          "bios"
          "bizarroal"
          "bmacaree"
          "boardy"
          "boddah"
          "bogus.anime.fakh"
          "bogus.bhudt.dacf"
          "bogus.citoge.baym"
          "bogus.electro.ba0a"
          "bogus.fencing.baw5"
          "bogus.harry.ba8f"
          "bogus.hui.hong.baci"
          "bogus.ironman.baqib"
          "bogus.joe.bach"
          "bogus.kenny.bas6"
          "bogus.kerswin.baybb"
          "bogus.kravmaga.ba0w"
          "bogus.methi.baq5"
          "bogus.nelsonmw.bauc"
          "bogus.poshea.ba0m"
          "bogus.redwolf.bawn"
          "bogus.romanov.baat"
          "bogus.ryan.bae-"
          "bogus.rynnea.bask"
          "bogus.sea.af"
          "bogus.shane.c.ba8z"
          "bogus.t1000.baggb"
          "bogus.ullrugby.ba8p"
          "brendan"
          "bubba"
          "c_material_removed"
          "ca_worm"
          "cactus"
          "carticus"
          "cathalc"
          "cathald-broken"
          "cdschedule"
          "celtic"
          "christine"
          "cian"
          "ciara"
          "ciaran"
          "colin"
          "cosmo"
          "counsel"
          "creosote"
          "crew"
          "cues"
          "cur"
          "cwhelan"
          "dac"
          "daktulu"
          "datacore"
          "davec"
          "daverus"
          "deano"
          "deccy"
          "declanmu"
          "deiji"
          "dermotmc"
          "derrick"
          "deshocks"
          "diarmuid"
          "dippy"
          "djraptor"
          "dmackey"
          "dmir"
          "dom"
          "dom_mckay"
          "donie"
          "donnacha"
          "dos30"
          "drazhar"
          "duffman"
          "eas"
          "electal"
          "emc"
          "emilia"
          "emma"
          "emmag"
          "ents"
          "envcom"
          "eoinh95"
          "epgriffin"
          "equest"
          "fiacc"
          "fint"
          "flanno"
          "fmannix"
          "foodcoop"
          "gamenet"
          "ganainm"
          "gar"
          "ger88"
          "ghama"
          "ging"
          "goborobo"
          "gooner"
          "greekweek"
          "hawking"
          "hb"
          "homer"
          "hoshi"
          "ian"
          "ianrice"
          "ilug"
          "infinity"
          "ingenuus"
          "internat"
          "jamessy"
          "jamiebarry"
          "jbravo"
          "jdonegan"
          "joedredd"
          "johann"
          "jokill"
          "jsoccer"
          "jules"
          "kate"
          "katie"
          "kellyj"
          "kiely"
          "koo"
          "l_d_ablo"
          "lakes"
          "laura"
          "lebowski"
          "liabraid"
          "lynn"
          "mal"
          "manuel"
          "maraz"
          "marieke"
          "marky"
          "mature"
          "mbyrne"
          "meanturtle"
          "mickaful"
          "mickasul"
          "mikado"
          "mikeh"
          "mikkel"
          "mixiezme"
          "mmc"
          "molly"
          "moochie"
          "moonser"
          "mopic"
          "mp"
          "nastros"
          "neutrino"
          "new"
          "nezzy"
          "nkdc"
          "nmcenroy"
          "noelle"
          "nugget"
          "ob"
          "omega"
          "oneillbeano"
          "pamela"
          "peterj"
          "photyl"
          "plake"
          "pmcg1986"
          "pyro"
          "qubeat"
          "rachel"
          "rachelg"
          "ralmeida"
          "raymond"
          "razzlero"
          "red"
          "rmacm"
          "rmorrissey"
          "robson"
          "selena"
          "shark"
          "shayscannell"
          "shazlove"
          "shelley"
          "shelly"
          "silver.old"
          "sirhc"
          "sithlord"
          "sk"
          "sligoer"
          "slowey"
          "smallp"
          "smurfy"
          "sordfish"
          "soul98"
          "soular"
          "st"
          "stefanovich"
          "svp"
          "szczerba"
          "tangsoodo"
          "tc"
          "tenfor"
          "teslacut"
          "theematt"
          "thomasl"
          "tockman"
          "ugm"
          "vanzan"
          "volleyb"
          "warren"
          "weather"
          "wiles"
          "yvonne"
          "zrahman"
        ];

      };

    };
  };
}