{ config, lib, pkgs, ... }:

with lib;

let

  cfg = config.services.customTinc;

  networkModule = {
    extraConfig = mkOption {
      default = ''
        PingTimeout = 10
      '';
      type = types.lines;
      description = ''
        Extra lines to add to the tinc service configuration file.
      '';
    };

    name = mkOption {
      default = null;
      type = types.nullOr types.str;
      description = ''
        The name of the node which is used as an identifier when communicating
        with the remote nodes in the mesh. If null then the hostname of the system
        is used.
      '';
    };

    debugLevel = mkOption {
      default = 0;
      type = types.addCheck types.int (l: l >= 0 && l <= 5);
      description = ''
        The amount of debugging information to add to the log. 0 means little
        logging while 5 is the most logging. <command>man tincd</command> for
        more details.
      '';
    };

    hosts = mkOption {
      default = { };
      type = types.loaOf types.lines;
      description = ''
        The name of the host in the network as well as the configuration for that host.
        This name should only contain alphanumerics and underscores.
      '';
    };

    interfaceType = mkOption {
      default = "tun";
      type = types.addCheck types.str (n: n == "tun" || n == "tap");
      description = ''
        The type of virtual interface used for the network connection
      '';
    };

    interfaceConfig = mkOption {
      default = { };
      description = ''
        Additional configuration for the generated network interface
      '';
    };

    package = mkOption {
      default = pkgs.tinc_pre;
      description = ''
        The package to use for the tinc daemon's binary.
      '';
    };

    scripts = mkOption {
      default = { };
      type = types.loaOf (types.nullOr types.str);
      description = ''
        Hook scripts
      '';
    };

    nmDispatch = mkOption {
      type = types.bool;
      default = config.networking.networkmanager.enable;
      description = ''
        Install a network-manager dispatcher script to automatically
        connect to all remotes when networking is available
      '';
    };

  };
in

{

  ###### interface

  options = {

    services.customTinc = {

      networks = mkOption {
        default = { };
        type = types.loaOf (types.submodule { options = networkModule; });
        description = ''
          Defines the tinc networks which will be started.
          Each network invokes a different daemon.
        '';
      };
    };

  };


  ###### implementation

  config = mkIf (cfg.networks != { }) {

    environment.etc = fold (a: b: a // b) { }
      (flip mapAttrsToList cfg.networks (network: data:
        flip mapAttrs' data.hosts (host: text: nameValuePair
          ("tinc/${network}/hosts/${host}")
          ({ inherit text; })
        ) // (flip mapAttrs' data.scripts (scriptName: text: nameValuePair
                                  ("tinc/${network}/${scriptName}")
                                  ({ mode = "0555"; inherit text; })
                                )) // {
          "tinc/${network}/tinc.conf" = {
            text = ''
              Name = ${if data.name == null then "$HOST" else data.name}
              DeviceType = ${data.interfaceType}
              Device = /dev/net/tun
              Interface = tinc.${network}
              ExperimentalProtocol = no
              ${data.extraConfig}
            '';
          };
        }
      ));

    networking.interfaces = flip mapAttrs' cfg.networks (network: data: nameValuePair
      ("tinc.${network}")
      ({
        virtual = true;
        virtualType = "${data.interfaceType}";
      } // data.interfaceConfig)
    );

    networking.networkmanager.dispatcherScripts = flip mapAttrs' cfg.networks (network: data: optional data.nmDispatch {
      type = "basic";
      source = pkgs.writeScript "connectRemotes.sh" ''
        #!${pkgs.stdenv.shell}

        shopt -s extglob

        case "''${2}" in
          (?(vpn-)up)
            systemctl --signal=ALRM --kill-who=main kill "tinc.${network}.service"
            ;;
        esac
      '';
    });

    systemd.services = flip mapAttrs' cfg.networks (network: data: nameValuePair
      ("tinc.${network}")
      ({
        description = "Tinc Daemon - ${network}";
        wantedBy = [ "network.target" ];
        after = [ "network-interfaces.target" ];
        restartTriggers = [ config.environment.etc."tinc/${network}/tinc.conf".source ]
          ++ mapAttrsToList (host: _ : config.environment.etc."tinc/${network}/hosts/${host}".source) data.hosts;
        serviceConfig = {
          Type = "simple";
          PIDFile = "/run/tinc.${network}.pid";
          ExecStart = ''
            ${data.package}/bin/tincd -D -L -U tinc.${network} -n ${network} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}
          '';
        };
        preStart = ''
          ${pkgs.openresolv}/bin/resolvconf -d tinc.${network} || true

          mkdir -p /etc/tinc/${network}/hosts

          # Determine how we should generate our keys
          if type tinc >/dev/null 2>&1; then
            # Tinc 1.1+ uses the tinc helper application for key generation
            [ -f "/etc/tinc/${network}/ed25519_key.priv" ] || tinc -n ${network} generate-ed25519-keys
            [ -f "/etc/tinc/${network}/rsa_key.priv" ] || tinc -n ${network} generate-rsa-keys 4096
          else
            # Tinc 1.0 uses the tincd application
            [ -f "/etc/tinc/${network}/rsa_key.priv" ] || tincd -n ${network} -K 4096
          fi
        '';
      })
    );

    users.extraUsers = flip mapAttrs' cfg.networks (network: _:
      nameValuePair ("tinc.${network}") ({
        description = "Tinc daemon user for ${network}";
        isSystemUser = true;
      })
    );

  };

}