{ config
, pkgs
, lib
, ...
}:

{
  options.services.ntfy-container = {
    enable = lib.mkEnableOption "ntfy service";
    port = lib.mkOption {
      type = lib.types.port;
      default = 8080;
      description = "Host port to map to ntfy";
    };
  };

  config = lib.mkIf config.services.ntfy-container.enable {
    services.ntfy-sh = {
      enable = true;
      settings = {
        base-url = "https://ntfy.edley.me";
        # Bind to all interfaces - nginx proxy (in Docker container) needs to reach it.
        # Security: firewall restricts access to nginx proxy machine only.
        listen-http = ":${toString config.services.ntfy-container.port}";
        cache-file = "/var/lib/ntfy-sh/cache.db";
        auth-file = "/var/lib/ntfy-sh/user.db";
        behind-proxy = true; # Explicitly enable proxy support (X-Forwarded-*)

        # Security: Deny all access by default, require login
        auth-default-access = "deny-all";
        enable-signup = false;
        enable-login = true;
        # Require login for ALL web app actions - hides the public UI
        # behind authentication so anonymous visitors can't even browse
        # the web app.
        require-login = true;
      };
    };

    # Firewall: allow access only from nginx proxy machine (adjust IP as needed).
    # Example: allow from 10.0.0.x (Tailscale IP of nginx proxy machine)
    # networking.firewall.allowedTCPPorts = [ config.services.ntfy-container.port ];
    # networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ config.services.ntfy-container.port ];

    # Ensure state directory exists (ntfy-sh service usually creates it, but good to ensure permissions if needed)
    # The systemd service for ntfy-sh usually handles DynamicUser/StateDirectory or similar.
    # We can trust the upstream module for basic setup.
  };
}