{ config, pkgs, ... }:
let
  certificateDir = "/var/lib/kanidm-tls";
in
{
  services.kanidm = {
    # Pin the minor release: Kanidm upgrades require following its upgrade guide.
    package = pkgs.kanidm_1_11;
    server = {
      enable = true;
      settings = {
        domain = "auth.tmmworkshop.com";
        origin = "https://auth.tmmworkshop.com";
        bindaddress = "0.0.0.0:8443";
        db_fs_type = "zfs";
        tls_chain = "${certificateDir}/certificate.pem";
        tls_key = "${certificateDir}/private-key.pem";

        # Only Portal may supply the original client address. HAProxy replaces
        # X-Forwarded-For, so clients cannot supply a forged address themselves.
        http_client_address_info.x-forward-for = [ "100.80.102.33" ];

        # /var/lib/kanidm is on root_pool/var, which is already snapshotted.
        online_backup = {
          schedule = "30 2 * * *";
          versions = 14;
        };
      };
    };
    client = {
      enable = true;
      settings.uri = "https://auth.tmmworkshop.com";
    };
  };

  systemd = {
    services = {
      kanidm = {
        requires = [ "kanidm-tls.service" ];
        after = [ "kanidm-tls.service" ];
      };

      # Kanidm requires TLS even behind HAProxy. Use Jeeves's Tailscale
      # certificate so Portal can verify both the CA and the backend hostname.
      # HTTPS certificates must be enabled in the Tailscale admin console.
      kanidm-tls = {
        description = "Obtain and renew Kanidm's backend TLS certificate";
        requires = [ "tailscaled.service" ];
        wants = [ "tailscaled-autoconnect.service" ];
        after = [
          "tailscaled.service"
          "tailscaled-autoconnect.service"
        ];
        path = [
          config.services.tailscale.package
          pkgs.coreutils
          pkgs.systemd
        ];
        serviceConfig = {
          Type = "oneshot";
          User = "root";
          Group = "kanidm";
          StateDirectory = "kanidm-tls";
          StateDirectoryMode = "0750";
          RuntimeDirectory = "kanidm-tls";
          RuntimeDirectoryMode = "0700";
          UMask = "0077";
          TimeoutStartSec = "2min";
        };
        script = ''
          set -euo pipefail
          tailscale cert --min-validity 720h \
            --cert-file /run/kanidm-tls/certificate.pem \
            --key-file /run/kanidm-tls/private-key.pem \
            jeeves.taile39c31.ts.net

          if ! cmp -s /run/kanidm-tls/certificate.pem ${certificateDir}/certificate.pem \
            || ! cmp -s /run/kanidm-tls/private-key.pem ${certificateDir}/private-key.pem; then
            install -m 0640 -o root -g kanidm /run/kanidm-tls/certificate.pem ${certificateDir}/certificate.pem
            install -m 0640 -o root -g kanidm /run/kanidm-tls/private-key.pem ${certificateDir}/private-key.pem

            # The NixOS service bind-mounts the certificate files, so restart to
            # pick up renewals. Do not wait on a service that depends on this one.
            if systemctl is-active --quiet kanidm.service; then
              systemctl --no-block try-restart kanidm.service
            fi
          fi
        '';
      };
    };

    timers.kanidm-tls = {
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnCalendar = "daily";
        Persistent = true;
        RandomizedDelaySec = "1h";
      };
    };
  };
}