{ config, ... }:
let
  PORT = config.svports.tranquil;
in
{
  services.tranquil-pds = {
    enable = true;

    environmentFiles = [ config.age.secrets.ivy-tranquil.path ];
    database.createLocally = true;

    settings = {
      server = {
        hostname = "tranquil.at.vt3e.cat";
        port = PORT;
        invite_code_required = true;
        age_assurance_override = true;
      };

      email = {
        from_address = "pds@mail.wlo.moe";
        from_name = "Tranquil PDS";

        smarthost = {
          host = "smtp.resend.com";
          port = 2587;
          username = "resend";
          tls = "starttls";
        };
      };
    };
  };

  services.caddy.virtualHosts."tranquil.at.vt3e.cat" = {
    serverAliases = [ "*.tranquil.at.vt3e.cat" ];
    extraConfig = ''
      encode zstd gzip
      tls {
        on_demand
      }

      reverse_proxy 127.0.0.1:${toString PORT}
    '';
  };
}