{ pkgs, lib, config, ... }:
let
  cfg = config.lab.data-sharing;

  nfsShares = [
    "/nextcloud/data"
    "/radicale"
    "/freshrss/data"
    "/freshrss/extensions"
    "/pihole/data"
    "/pihole/dnsmasq"
    "/hedgedoc/uploads"
    "/traefik/acme"
    "/forgejo/data"
    "/forgejo/runner/data"
    "/forgejo/runner/certs"
    "/kitchenowl/data"
    "/syncthing/config"
    "/paperless-ngx/data"
    "/paperless-ngx/redisdata"
    "/media"
    "/media/books"
    "/media/movies"
    "/media/music"
    "/media/shows"
    "/jellyfin/config"
    "/transmission/config"
    "/jellyseerr/config"
    "/radarr/config"
    "/prowlarr/config"
    "/sonarr/config"
    "/bazarr/config"
    "/minecraft"
    "/atticd"
  ];

  nfsExports = lib.strings.concatLines (
    builtins.map
      (share:
        "${cfg.nfsRoot}${share} 192.168.30.0/16(rw,sync,no_subtree_check,no_root_squash)"
      )
      nfsShares
  );
in
{
  options.lab.data-sharing = {
    enable = lib.mkOption {
      default = false;
      type = lib.types.bool;
      description = ''
        Configure this server to serve our data using NFS and PostgreSQL.
      '';
    };

    nfsRoot = lib.mkOption {
      default = "/mnt/data/nfs";
      type = lib.types.str;
      description = ''
        Root directory of NFS data.
      '';
    };

    postgresDir = lib.mkOption {
      default = "/mnt/data/postgresql/${config.services.postgresql.package.psqlSchema}";
      type = lib.types.str;
      description = ''
        Postgresql data directory.
      '';
    };
  };

  config = lib.mkIf cfg.enable {
    networking.firewall.allowedTCPPorts = [
      2049 # NFS
      5432 # PostgeSQL
      111 # NFS
      20048 # NFS
    ];

    services = {
      nfs.server = {
        enable = true;
        exports = nfsExports;
      };

      postgresql = {
        enable = true;
        package = pkgs.postgresql_15;
        enableTCPIP = true;

        dataDir = cfg.postgresDir;

        authentication = ''
          host	nextcloud	nextcloud	all	      md5
          host	hedgedoc	hedgedoc	all	      md5
          host	paperless	paperless	all	      md5
          host  attic           attic           all           md5
        '';
      };
    };
  };
}