{ pkgs, config, lib, ... }:
let
  domain = "bnc.oxapentane.com";
  certDir = config.security.acme.certs.${domain}.directory;
in
{
  # so soju can read the cert
  users.groups.soju-tls = {};

  sops.secrets = {
    mythicbeasts-acme-bnc-api = {
      owner = "root";
      group = "root";
      mode = "0400";
    };
    mythicbeasts-acme-bnc-api-secret = {
      owner = "root";
      group = "root";
      mode = "0400";
    };
  };

  # get the cert via DNS
  security.acme = {
    acceptTerms = true;
    certs.${domain} = {
      dnsProvider = "mythicbeasts";
      credentialFiles = {
        "MYTHICBEASTS_USERNAME_FILE" = config.sops.secrets.mythicbeasts-acme-bnc-api.path;
        "MYTHICBEASTS_PASSWORD_FILE" = config.sops.secrets.mythicbeasts-acme-bnc-api-secret.path;
      };
      group = "soju-tls";
      reloadServices = [
        "soju.service"
      ];
    };
  };

  # open port
  networking.firewall.allowedTCPPorts = [
    6697
  ];

  # soju config
  services.soju = {
    enable = true;
    hostName = domain;
    listen = [
      "ircs://:6697"
    ];

    tlsCertificate = "${certDir}/fullchain.pem";
    tlsCertificateKey = "${certDir}/key.pem";

    adminSocket.enable = true;
    enableMessageLogging = true;
  };

  systemd.services.soju = {
    wants = [ "acme-${domain}.service" ];
    after = [ "acme-${domain}.service" ];
    serviceConfig.SupplementaryGroups = [ "soju-tls" ];
  };

  # make sure that creds are there, before contacting letsencrypt
  systemd.services."acme-order-renew-${domain}" =
    lib.mkIf config.sops.useSystemdActivation
      {
        requires = [ "sops-install-secrets.service" ];
        after = [ "sops-install-secrets.service" ];
      };

  environment.systemPackages = [ pkgs.soju ];
}