# NixOS module for the n8n OpenAI-compatible adapter.
#
# Consume from config-nixos:
#   imports = [ inputs.n8n-openai-adapter.nixosModules.default ];
#   services.n8n-openai-adapter = {
#     enable = true;
#     domain = "openai.bueso.eu";
#     port = 8134;
#   };
#
# The module defines the systemd service, the service user, and the sops secret
# (`n8n_openai_env` carrying ADAPTER_API_KEY + AGENTS). The nginx vhost is NOT
# defined here — add it in the consuming config (config-nixos has its own
# nginx.nix with ACME/SSL). This keeps the flake self-contained for the service
# while the site exposure stays a deployment concern.
{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.services.n8n-openai-adapter;
in
{
  options.services.n8n-openai-adapter = {
    enable = lib.mkEnableOption "n8n OpenAI-compatible adapter";

    package = lib.mkOption {
      type = lib.types.package;
      default = pkgs.n8n-openai-adapter;
      description = "The n8n-openai-adapter package (from the overlay).";
    };

    port = lib.mkOption {
      type = lib.types.port;
      default = 8134;
      description = "Port the adapter HTTP server listens on (nginx proxies to it).";
    };

    domain = lib.mkOption {
      type = lib.types.str;
      description = "Domain the adapter is served under (used for the nginx vhost in the consuming config).";
    };
  };

  config = lib.mkIf cfg.enable {
    sops.secrets.n8n_openai_env = {
      owner = "n8n-openai";
      group = "n8n-openai";
      mode = "0440";
    };

    systemd.services.n8n-openai-adapter = {
      description = "OpenAI-compatible adapter for n8n chat agents";
      wantedBy = [ "multi-user.target" ];
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      serviceConfig = {
        ExecStart = "${cfg.package}/bin/n8n_openai_adapter start";
        EnvironmentFile = "/run/secrets/n8n_openai_env";
        Environment = [
          "PORT=${toString cfg.port}"
          # Agents are managed at runtime via the admin API and persisted here.
          "AGENTS_FILE=/var/lib/n8n-openai/agents.json"
          # Elixir release needs a cookie; the release's start script reads
          # releases/COOKIE which isn't baked in, so set it explicitly.
          "RELEASE_COOKIE=n8n-openai-adapter"
        ];
        Restart = "always";
        RestartSec = 5;
        User = "n8n-openai";
        Group = "n8n-openai";
        StateDirectory = "n8n-openai";
      };
    };

    users.users.n8n-openai = {
      isSystemUser = true;
      group = "n8n-openai";
      home = "/var/lib/n8n-openai";
      createHome = true;
    };
    users.groups.n8n-openai = { };
  };
}