{ config, pkgs, ... }:

let
  relayScript = pkgs.writeText "gitea-hermes-webhook-relay.py" (
    builtins.readFile ./gitea-hermes-webhook-relay.py
  );
in
{
  systemd.services.gitea-hermes-webhook-relay = {
    description = "Normalize Gitea PR webhooks for Hermes Agent";
    wantedBy = [ "multi-user.target" ];
    wants = [ "network-online.target" ];
    after = [
      "network-online.target"
      "podman-hermes-agent.service"
      "tailscaled-autoconnect.service"
    ];

    environment = {
      LISTEN_HOST = "0.0.0.0";
      LISTEN_PORT = "8645";
      HERMES_WEBHOOK_URL = "http://127.0.0.1:8644/webhooks/gitea-events";
      MAX_BODY_BYTES = "1048576";
    };

    serviceConfig = {
      ExecStart = "${pkgs.python3}/bin/python ${relayScript}";
      LoadCredential = [
        "webhook_secret:${config.sops.secrets.gitea_hermes_webhook_secret.path}"
      ];
      DynamicUser = true;
      Restart = "on-failure";
      RestartSec = 5;
      PrivateDevices = true;
      PrivateTmp = true;
      ProtectHome = true;
      ProtectSystem = "strict";
      NoNewPrivileges = true;
      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
      RestrictRealtime = true;
      UMask = "0077";
    };
  };

  # The relay forwards into a named Hermes webhook subscription. Keep the
  # subscription declaratively present without replacing the rest of Hermes's
  # runtime-managed webhook state. The secret is already in the container's
  # environment file, but never appears in this unit or the Nix store.
  systemd.services.hermes-agent-webhook-route = {
    description = "Configure Hermes Gitea PR comment webhook route";
    wantedBy = [ "multi-user.target" ];
    after = [ "podman-hermes-agent.service" ];
    requires = [ "podman-hermes-agent.service" ];
    path = [ pkgs.podman ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
    script = ''
      set -euo pipefail

      # The container unit is ordered before us, but its gateway may still be
      # warming up while the image initializes its persistent state directory.
      for _ in $(seq 1 60); do
        if podman exec hermes-agent hermes webhook list >/dev/null 2>&1; then
          break
        fi
        sleep 1
      done

      podman exec hermes-agent hermes webhook remove gitea-pr-comments >/dev/null 2>&1 || true
      podman exec hermes-agent hermes webhook remove gitea-events >/dev/null 2>&1 || true
      podman exec hermes-agent sh -c '
        hermes webhook subscribe gitea-events \
          --secret "$GITEA_HERMES_WEBHOOK_SECRET" \
          --description "Forward authenticated Gitea events to L.U.N.A." \
          --deliver telegram --deliver-chat-id "15151223"
      '
    '';
  };
}