# OpenWebUI Podman Module
# Provides: Web interface for LLMs using official Docker image
#
# Usage:
#   myModules.open-webui-podman = {
#     enable = true;
#     port = 9000;
#     domain = "ai.example.com";
#     ollamaUrl = "http://100.64.0.1:11434";
#   };

{
  config,
  lib,
  pkgs,
  ...
}:

let
  cfg = config.myModules.open-webui-podman;
in
{
  options.myModules.open-webui-podman = {
    enable = lib.mkEnableOption "OpenWebUI for LLMs via Podman";

    port = lib.mkOption {
      type = lib.types.port;
      default = 9000;
      description = "Port to expose OpenWebUI on localhost";
    };

    domain = lib.mkOption {
      type = lib.types.str;
      example = "ai.example.com";
      description = "Public domain name for OpenWebUI";
    };

    ollamaUrl = lib.mkOption {
      type = lib.types.str;
      default = "http://127.0.0.1:11434";
      example = "http://100.64.0.1:11434";
      description = "URL of the Ollama API endpoint";
    };
  };

  config = lib.mkIf cfg.enable {
    # Ensure podman is enabled
    myModules.podman.enable = true;

    # Podman container for OpenWebUI
    virtualisation.oci-containers.containers.open-webui = {
      image = "ghcr.io/open-webui/open-webui:main";
      ports = ["127.0.0.1:${toString cfg.port}:8080"];
      environment = {
        OLLAMA_API_BASE_URL = cfg.ollamaUrl;
        WEBUI_URL = "https://${cfg.domain}";
      };
      environmentFiles = [config.sops.templates."openwebui-podman.env".path];
      volumes = [
        "open-webui-data:/app/backend/data"
      ];
    };

    # SOPS template for secrets
    sops.templates."openwebui-podman.env" = {
      content = ''
        WEBUI_SECRET_KEY=${config.sops.placeholder.openwebui_secret_key}
      '';
    };

    sops.secrets.openwebui_secret_key = { };

    # Nginx configuration
    myModules.nginx.domains.${cfg.domain} = {
      port = cfg.port;
      extraConfig = ''
        client_max_body_size 100M;
      '';
      # WebSocket support for /ws/
      extraLocations."/ws/" = {
        proxyPass = "http://127.0.0.1:${toString cfg.port}";
        extraConfig = ''
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header Host $host;
          proxy_read_timeout 86400;
          proxy_send_timeout 86400;
        '';
      };
      # Relaxed CSP for OpenWeb UI
      contentSecurityPolicy = "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' wss: https:; frame-ancestors 'self'";
    };
  };
}