{ pkgs, lib, ... }:

let
  jmusicbot = pkgs.stdenv.mkDerivation {
    pname = "jmusicbot";
    version = "0.7.1";

    src = pkgs.fetchurl {
      url = "https://github.com/mutedvector/MusicBot/releases/download/v0.7.1/JMusicBot-0.7.1.jar";
      hash = "sha256-NNM6WUKS1pfHfQ4DVbb6/hx0hSpH3W5RjFdawKLpr2c=";
    };

    dontUnpack = true;

    nativeBuildInputs = [ pkgs.makeBinaryWrapper ];

    installPhase = ''
      runHook preInstall

      mkdir -p $out/lib
      cp $src $out/lib/JMusicBot-0.7.1.jar

      makeBinaryWrapper ${pkgs.jdk25_headless}/bin/java $out/bin/jmusicbot \
        --prefix PATH : ${lib.makeBinPath [ pkgs.jdk25_headless ]} \
        --add-flags "-Dfile.encoding=UTF-8" \
        --add-flags "-Dnogui=true" \
        --add-flags "--enable-native-access=ALL-UNNAMED" \
        --add-flags "-XX:+UseZGC" \
        --add-flags "-XX:+AlwaysPreTouch" \
        --add-flags "-jar $out/lib/JMusicBot-0.7.1.jar"

      runHook postInstall
    '';

    meta = with lib; {
      description = "A Discord music bot that's easy to set up (arif-banai fork)";
      homepage = "https://github.com/arif-banai/MusicBot";
      license = licenses.mit;
      mainProgram = "jmusicbot";
    };
  };
in
{
  environment.systemPackages = [ jmusicbot ];

  users.users.jmusicbot = {
    isSystemUser = true;
    group = "jmusicbot";
    home = "/var/lib/jmusicbot";
    createHome = true;
    description = "JMusicBot service user";
  };
  users.groups.jmusicbot = { };

  systemd.services.jmusicbot = {
    description = "JMusicBot – Discord music bot (arif-banai fork)";
    after = [ "network-online.target" ];
    wants = [ "network-online.target" ];
    wantedBy = [ "multi-user.target" ];

    serviceConfig = {
      Type = "simple";
      User = "jmusicbot";
      Group = "jmusicbot";
      WorkingDirectory = "/var/lib/jmusicbot";

      ExecStart = "${jmusicbot}/bin/jmusicbot";

      NoNewPrivileges = true;
      ProtectSystem = "strict";
      ProtectHome = true;
      PrivateTmp = true;
      PrivateDevices = true;
      ProtectKernelTunables = true;
      ProtectKernelModules = true;
      ProtectControlGroups = true;
      RestrictAddressFamilies = [
        "AF_INET"
        "AF_INET6"
        "AF_UNIX"
      ];
      RestrictNamespaces = true;
      LockPersonality = true;
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      RemoveIPC = true;
      CapabilityBoundingSet = [ "" ];
      SystemCallArchitectures = "native";
      ReadWritePaths = [ "/var/lib/jmusicbot" ];

      Restart = "on-failure";
      RestartSec = 10;
      StartLimitBurst = 5;
      StartLimitIntervalSec = 60;

      MemoryMax = "1G";
      TasksMax = 512;
    };
  };
}