{ config, lib, pkgs, ... }:

let cfg = config.sydnix.deertopia.murmur;
in {
  options = {
    sydnix.deertopia.murmur = {
      enable = lib.mkEnableOption "Deertopia's Murmur, a Mumble server";
    };
  };

  config = lib.mkIf cfg.enable {

    sydnix.impermanence.directories = [
      config.services.murmur.stateDir
    ];

    # HACK: Allow Murmur to use Nginx's certs.
    systemd.services.murmur.serviceConfig.SupplementaryGroups = [ "nginx" ];

    services.murmur = {
      enable = true;
      openFirewall = true;

      password = "onlydeer";
      port = 64738;
      welcometext = "🦌";

      bandwidth = 72000;

      # Use files generated by Nix's Nginx module.
      sslCert = "/var/lib/acme/deertopia.net/fullchain.pem";
      sslKey = "/var/lib/acme/deertopia.net/key.pem";
    };
  };
}