{
  config,
  lib,
  pkgs,
  ...
}:

let
  cfg = config.modules.services.matrix-synapse;
  validBridges = [
    "signal"
    "whatsapp"
  ];
in {
  options.modules.services.matrix-synapse = {
    enable = lib.mkOption {
      default = false;
      example = true;
    };
    enableElementWeb = lib.mkOption {
      default = true;
      example = false;
    };
    bridges = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      description = "A list of bridges to configure with Synapse.";
      example = [ "signal" "whatsapp" ];
      default = [];
      apply = bridges:
        if lib.all (bridge: lib.elem bridge validBridges) bridges
        then lib.map (b: "mautrix-${b}") bridges
        else throw "Invalid bridge(s) specified. Valid bridges are: ${lib.concatStringsSep ", " validBridges}";
    };
    serverName = lib.mkOption {
      type = lib.types.str;
      default = "vimium.com";
      example = "vimium.com";
    };
    usePostgresql = lib.mkOption {
      default = false;
      example = true;
    };
  };

  config = let
    mkBridgeDatabase = bridge: {
      name = bridge;
      ensureDBOwnership = true;
    };
    commonBridgeSettings = bridge: {
      appservice = {
        database = lib.mkIf cfg.usePostgresql {
          type = "postgres";
          uri = "postgresql:///${bridge}?host=/run/postgresql";
        };
      };
      bridge = {
        encryption = {
          allow = true;
          default = true;
          require = true;
        };
        permissions = {
          "${cfg.serverName}" = "user";
        };
        provisioning = {
          shared_secret = "disable";
        };
      };
    };
    matrixClientConfig = {
      "m.homeserver" = {
        base_url = "https://matrix.${cfg.serverName}";
        server_name = cfg.serverName;
      };
      "m.identity_server" = {};
    };
    matrixServerConfig."m.server" = "matrix.${cfg.serverName}:443";
    mkWellKnown = data: ''
      more_set_headers 'Content-Type: application/json';
      return 200 '${builtins.toJSON data}';
    '';
  in lib.mkIf cfg.enable {
    networking.firewall.allowedTCPPorts = [
      8448 # Matrix federation
    ];

    security.acme.certs = {
      "matrix.${cfg.serverName}" = {
        reloadServices = [ "matrix-synapse" ];
      };
    };

    services.nginx.virtualHosts = {
      "matrix.${cfg.serverName}" = {
        forceSSL = true;
        enableACME = true;
        listen = [
          {
            addr = "0.0.0.0";
            port = 443;
            ssl = true;
          }
          {
            addr = "0.0.0.0";
            port = 80;
          }
          {
            addr = "0.0.0.0";
            port = 8448;
            ssl = true;
          }
          {
            addr = "[::1]";
            port = 443;
            ssl = true;
          }
          {
            addr = "[::1]";
            port = 80;
          }
          {
            addr = "[::1]";
            port = 8448;
            ssl = true;
          }
        ];
        locations = {
          "/" = {
            proxyPass = "http://localhost:8008";
            extraConfig = ''
              proxy_set_header X-Forwarded-For $remote_addr;
            '';
          };
          "/_matrix" = {
            proxyPass = "http://localhost:8008";
            extraConfig = ''
              proxy_set_header X-Forwarded-For $remote_addr;
              client_max_body_size 50M;
            '';
          };
          "/_synapse/client".proxyPass = "http://localhost:8008";
        };
      };
      "${cfg.serverName}" = {
        locations."= /.well-known/matrix/server".extraConfig = (mkWellKnown matrixServerConfig);
        locations."= /.well-known/matrix/client".extraConfig = (mkWellKnown matrixClientConfig);
      };
    } // (if cfg.enableElementWeb then {
      "chat.${cfg.serverName}" = {
        forceSSL = true;
        enableACME = true;
        root = pkgs.unstable.element-web.override {
          conf = {
            default_server_config = matrixClientConfig;
            brand = "Vimium Chat";
            branding = {
              auth_header_logo_url = "https://vimium.com/images/logo.svg";
              auth_footer_links = [
                { "text" = "Vimium.com"; "url" = "https://vimium.com"; }
              ];
            };
          };
        };
      };
    } else {});

    services.matrix-synapse = {
      enable = true;
      enableRegistrationScript = true;
      settings = {
        database.name = (if cfg.usePostgresql then "psycopg2" else "sqlite3");
        enable_metrics = false;
        enable_registration = false;
        max_upload_size = "100M";
        report_stats = false;
        server_name = cfg.serverName;
      };
    };

    services.postgresql = lib.mkIf cfg.usePostgresql {
      ensureUsers = [
        {
          name = "matrix-synapse";
          ensureDBOwnership = true;
        }
      ] ++ lib.map mkBridgeDatabase cfg.bridges;
      ensureDatabases = [
        "matrix-synapse"
      ] ++ cfg.bridges;
    };

    services.mautrix-signal = lib.mkIf (lib.elem "mautrix-signal" cfg.bridges) {
      enable = true;
      settings = commonBridgeSettings "mautrix-signal";
    };

    services.mautrix-whatsapp = lib.mkIf (lib.elem "mautrix-whatsapp" cfg.bridges) {
      enable = true;
      settings = {
        bridge = {
          history_sync = {
            backfill = true;
            max_initial_conversations = -1;
            message_count = 50;
            request_full_sync = false;
          };
          mute_bridging = true;
        };
      } // commonBridgeSettings "mautrix-whatsapp";
    };
  };
}