{ config, ... }:

let
  inherit (config.virtualisation.quadlet) containers networks;
  authentikEnv = config.sops.secrets."containers/authentik.env".path;
  outpostEnv = config.sops.secrets."containers/authentik-outpost.env".path;
in
{
  sops.secrets = {
    "containers/authentik.env" = {
      sopsFile = ../../secrets/authentik.env;
      format = "dotenv";
      key = "";
      mode = "0400";
      restartUnits = [
        "authentik-db.service"
        "authentik-server.service"
        "authentik-worker.service"
      ];
    };

    "containers/authentik-outpost.env" = {
      sopsFile = ../../secrets/authentik-outpost.env;
      format = "dotenv";
      key = "";
      mode = "0400";
      restartUnits = [ "authentik-outpost-ldap.service" ];
    };
  };

  virtualisation.quadlet = {
    networks.authentik = { };

    containers = {
      authentik-db = {
        containerConfig = {
          image = "docker.io/library/postgres:16-alpine";
          networks = [ networks.authentik.ref ];
          networkAliases = [ "postgresql" ];
          volumes = [
            "/home/imnyang/Docker/authentik/postgres_data:/var/lib/postgresql/data:Z"
          ];
          environmentFiles = [ authentikEnv ];
          healthCmd = "pg_isready -d authentik -U authentik";
          healthInterval = "30s";
          healthRetries = 5;
          healthStartPeriod = "20s";
          healthTimeout = "5s";
        };

        serviceConfig.Restart = "always";
      };

      authentik-server = {
        containerConfig = {
          image = "ghcr.io/goauthentik/server:2026.5.0";
          exec = "server";
          networks = [ networks.authentik.ref ];
          publishPorts = [
            "9080:9000"
            "9443:9443"
          ];
          volumes = [
            "/home/imnyang/Docker/authentik/media:/media:Z"
            "/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
          ];
          environmentFiles = [ authentikEnv ];
        };

        unitConfig = {
          Requires = [ containers."authentik-db".ref ];
          After = [ containers."authentik-db".ref ];
        };

        serviceConfig.Restart = "always";
      };

      authentik-worker = {
        containerConfig = {
          image = "ghcr.io/goauthentik/server:2026.5.0";
          exec = "worker";
          user = "root";
          networks = [ networks.authentik.ref ];
          volumes = [
            "/home/imnyang/Docker/authentik/certs:/certs:Z"
            "/home/imnyang/Docker/authentik/media:/media:Z"
            "/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
            "/var/run/docker.sock:/var/run/docker.sock"
          ];
          environmentFiles = [ authentikEnv ];
        };

        unitConfig = {
          Requires = [ containers."authentik-db".ref ];
          After = [ containers."authentik-db".ref ];
        };

        serviceConfig.Restart = "always";
      };

      authentik-outpost-ldap = {
        containerConfig = {
          image = "ghcr.io/goauthentik/ldap:2026.5.0";
          entrypoint = [ "/ldap" ];
          user = "1000";
          networks = [ networks.authentik.ref ];
          publishPorts = [
            "389:3389"
            "636:6636"
          ];
          environmentFiles = [ outpostEnv ];
        };

        unitConfig = {
          Requires = [ containers."authentik-server".ref ];
          After = [ containers."authentik-server".ref ];
        };

        serviceConfig.Restart = "always";
      };
    };
  };
}