{ pkgs, ... }:

let
  domain = "rtmps.mizuki.guru";
  caddyCertDir = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${domain}";
in
{
  services.nginx = {
    enable = true;
    package = pkgs.nginx.override {
      modules = [ pkgs.nginxModules.rtmp ];
    };

    appendConfig = ''
      rtmp {
        server {
          listen 127.0.0.1:19350;
          chunk_size 4096;

          application live {
            live on;
            record off;
          }
        }
      }
    '';
  };

  systemd.services.rtmps-stunnel = {
    description = "RTMPS TLS terminator for nginx-rtmp";
    after = [
      "network-online.target"
      "caddy.service"
      "nginx.service"
    ];
    wants = [ "network-online.target" ];
    requires = [ "nginx.service" ];
    wantedBy = [ "multi-user.target" ];

    serviceConfig = {
      Type = "simple";
      User = "caddy";
      Group = "caddy";
      ExecStart = "${pkgs.stunnel}/bin/stunnel ${pkgs.writeText "rtmps-stunnel.conf" ''
        foreground = yes
        pid =

        [rtmps]
        accept = 0.0.0.0:1935
        connect = 127.0.0.1:19350
        cert = ${caddyCertDir}/${domain}.crt
        key = ${caddyCertDir}/${domain}.key
      ''}";
      Restart = "always";
      RestartSec = 5;
    };
  };

  networking.firewall.allowedTCPPorts = [ 1935 ];
}