{ config, pkgs, lib, ... }:

{
  services.mattermost = {
    enable = true;

    # The defaults, here for easy reference.
    host = "127.0.0.1";
    port = 8065;

    # This is a placeholder, since it's the one domain name that's actually
    # mapped to this server right now. Under no circumstances should we ever
    # expose Mattermost directly to traffic from the internet, it always needs
    # to be behind our reverse proxy, so please don't actually open the port
    # or anything like that. Use an ssh tunnel for experimenting with it,
    # until then.
    siteUrl = "https://experiments.internetsafetylabs.org";

    # For the usual nix reasons, we prefer to disable Mattermost's in-band
    # configuration and do all config through nix.
    preferNixConfig = true;

    telemetry = {
      enableDiagnostics = false;
      enableSecurityAlerts = false;
    };

    database.peerAuth = true;
  };

  services.postgresqlBackup.databases = [ "mattermost" ];
}