{ lib, pkgs, config, ... }:
let
  cfg = config.myServices.websites.leila.production;
  varDir = "/var/lib/ftp/leila";
  apacheUser = config.services.httpd.Prod.user;
  apacheGroup = config.services.httpd.Prod.group;
in {
  options.myServices.websites.leila.production.enable = lib.mkEnableOption "enable Leila's websites in production";

  config = lib.mkIf cfg.enable {
    services.phpfpm.pools.leila = {
      user = apacheUser;
      group = apacheGroup;
      settings = {
        "listen.owner" = apacheUser;
        "listen.group" = apacheGroup;

        "pm" = "ondemand";
        "pm.max_children" = "5";
        "pm.process_idle_timeout" = "60";

        "php_admin_value[open_basedir]" = "${varDir}:/tmp";
        "php_admin_value[max_execution_time]" = "1800";
      };
      phpOptions = config.services.phpfpm.phpOptions + ''
        disable_functions = "mail"
      '';
      phpPackage = pkgs.php72.withExtensions({ enabled, all }: enabled ++ [ all.imagick ]);
      phpEnv = {
        PATH = lib.makeBinPath [ pkgs.imagemagick ];
      };
    };

    services.webstats.sites = [
      { name = "leila.bouya.org"; }
      { name = "chorale.leila.bouya.org"; }
      { name = "syrwennecreation.bouya.org"; }
    ];

    services.websites.env.production.modules = [ "proxy_fcgi" ];
    services.websites.env.production.vhostConfs.leila_chorale = {
      certName    = "leila";
      addToCerts  = true;
      hosts       = [ "chorale.leila.bouya.org" "chorale-vocanta.fr.nf" "www.chorale-vocanta.fr.nf" ];
      root        = "${varDir}/Chorale";
      extraConfig = [
        ''
        Use Stats chorale.leila.bouya.org
        <Directory ${varDir}/Chorale>
          DirectoryIndex index.php index.htm index.html
          Options Indexes FollowSymLinks MultiViews Includes
          AllowOverride None

          Use LDAPConnect
          Require ldap-group cn=chorale.leila.bouya.org,cn=httpd,ou=services,dc=immae,dc=eu

          <FilesMatch "\.php$">
            SetHandler "proxy:unix:${config.services.phpfpm.pools.leila.socket}|fcgi://localhost"
          </FilesMatch>
        </Directory>
          ''
      ];
    };
    services.websites.env.production.vhostConfs.leila_syrwenne = {
      certName    = "leila";
      addToCerts  = true;
      hosts       = [ "syrwennecreation.bouya.org" ];
      root        = "${varDir}/Syrwennecreation";
      extraConfig = [
        ''
        Use Stats syrwennecreation.bouya.org
        <Directory ${varDir}/Syrwennecreation>
          DirectoryIndex index.php index.htm index.html
          Options Indexes FollowSymLinks MultiViews Includes
          AllowOverride None

          <FilesMatch "\.php$">
            SetHandler "proxy:unix:${config.services.phpfpm.pools.leila.socket}|fcgi://localhost"
          </FilesMatch>
        </Directory>
          ''
      ];
    };
    services.websites.env.production.vhostConfs.leila = {
      certName     = "leila";
      certMainHost = "leila.bouya.org";
      hosts        = [ "leila.bouya.org" ];
      root         = varDir;
      extraConfig  = [
        ''
        Use Stats leila.bouya.org
        <Directory ${varDir}/Chorale>
          DirectoryIndex index.htm index.html
          Options Indexes FollowSymLinks MultiViews Includes
          AllowOverride None

          Use LDAPConnect
          Require ldap-group cn=chorale.leila.bouya.org,cn=httpd,ou=services,dc=immae,dc=eu

          <FilesMatch "\.php$">
            SetHandler "proxy:unix:${config.services.phpfpm.pools.leila.socket}|fcgi://localhost"
          </FilesMatch>
        </Directory>
        <Directory ${varDir}>
          DirectoryIndex index.htm index.html
          Options Indexes FollowSymLinks MultiViews Includes
          AllowOverride None
          Require all granted
        </Directory>
          ''
      ];
    };
  };
}