{ lib, namespace, ... }:
with lib;
{
  options.${namespace}.services.tabby-web = {
    enable = mkEnableOption "Tabby Web terminal application server";

    port = mkOption {
      type = types.port;
      default = 9000;
      description = "Port for tabby-web server";
    };

    openFirewall = mkOption {
      type = types.bool;
      default = false;
      description = "Whether to open firewall for tabby-web";
    };

    user = mkOption {
      type = types.str;
      default = "tabby-web";
      description = "User to run tabby-web as";
    };

    group = mkOption {
      type = types.str;
      default = "tabby-web";
      description = "Group to run tabby-web as";
    };

    dataDir = mkOption {
      type = types.path;
      default = "/var/lib/tabby-web";
      description = "Directory to store tabby-web data";
    };

    databaseUrl = mkOption {
      type = types.str;
      default = "sqlite:///var/lib/tabby-web/tabby.db";
      description = "Database connection URL";
      example = "postgresql://user:password@localhost:5432/tabby";
    };

    appDistStorage = mkOption {
      type = types.str;
      default = "file:///var/lib/tabby-web/dist";
      description = "Storage URL for app distributions";
      example = "s3://my-bucket/tabby-dist";
    };

    socialAuth = {
      github = {
        key = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = "GitHub OAuth key";
        };
        secret = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = "GitHub OAuth secret";
        };
      };

      gitlab = {
        key = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = "GitLab OAuth key";
        };
        secret = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = "GitLab OAuth secret";
        };
      };

      microsoftGraph = {
        key = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = "Microsoft Graph OAuth key";
        };
        secret = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = "Microsoft Graph OAuth secret";
        };
      };

      googleOauth2 = {
        key = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = "Google OAuth2 key";
        };
        secret = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = "Google OAuth2 secret";
        };
      };
    };

    extraEnvironment = mkOption {
      type = types.attrsOf types.str;
      default = { };
      description = "Extra environment variables for tabby-web";
      example = {
        DEBUG = "1";
        LOG_LEVEL = "info";
      };
    };

    workers = mkOption {
      type = types.ints.positive;
      default = 4;
      description = "Number of gunicorn worker processes";
    };

    timeout = mkOption {
      type = types.ints.positive;
      default = 120;
      description = "Worker timeout in seconds";
    };
  };
}