{ config, pkgs, lib, ... }:
{
  services.memcached = {
    enable = true;
    maxMemory = 256;
    listen = "127.0.0.1";
    port = 11211;
  };

  services.mediawiki = {
    enable = true;
    name = "Noisebridge";
    url = "https://www.noisebridge.net";
    passwordFile = config.age.secrets.mediawiki-secret-key.path;

    database = {
      type = "mysql";
      name = "noisebridge_mediawiki";
      user = "wiki";
      passwordFile = config.age.secrets.mysql-mediawiki.path;
      socket = "/run/mysqld/mysqld.sock";
      createLocally = false;
    };

    extensions = {
      # Bundled extensions
      CiteThisPage = null;
      Cite = null;
      ConfirmEdit = null;
      Gadgets = null;
      ImageMap = null;
      InputBox = null;
      Interwiki = null;
      LocalisationUpdate = null;
      Nuke = null;
      ParserFunctions = null;
      PdfHandler = null;
      Poem = null;
      Renameuser = null;
      SpamBlacklist = null;
      SyntaxHighlight_GeSHi = null;
      TitleBlacklist = null;
      WikiEditor = null;
      CategoryTree = null;
      CodeEditor = null;
      VisualEditor = null;
      Scribunto = null;
      TemplateData = null;
      TextExtracts = null;
      PageImages = null;
      Popups = null;
      MultimediaViewer = null;
      Math = null;
      ReplaceText = null;
      SecureLinkFixer = null;
    };

    skins = {
      Vector = null;
    };

    extraConfig = ''
      # ----- Branding & URLs -----
      $wgMetaNamespace = "Noisebridge";
      $wgSitename = "Noisebridge";
      $wgServer = "https://www.noisebridge.net";
      $wgScriptPath = "";
      $wgArticlePath = "/wiki/$1";
      $wgUsePathInfo = true;
      $wgLogo = "$wgResourceBasePath/resources/assets/noisebridge-logo.png";

      # ----- Skin: Vector 2022 only -----
      $wgDefaultSkin = "vector-2022";
      $wgVectorDefaultSkinVersion = "2";
      $wgSkipSkins = [ "cologneblue", "monobook", "modern", "timeless" ];

      # ----- Locale & License -----
      $wgLanguageCode = "en";
      $wgLocaltimezone = "America/Los_Angeles";
      $wgRightsPage = "";
      $wgRightsUrl = "https://creativecommons.org/licenses/by-sa/4.0/";
      $wgRightsText = "Creative Commons Attribution-ShareAlike";
      $wgRightsIcon = "$wgResourceBasePath/resources/assets/licenses/cc-by-sa.png";

      # ----- Database -----
      $wgDBtype = "mysql";
      $wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary";

      # ----- Memcached -----
      $wgMainCacheType = CACHE_MEMCACHED;
      $wgMemCachedServers = [ "127.0.0.1:11211" ];
      $wgSessionCacheType = CACHE_MEMCACHED;
      $wgMessageCacheType = CACHE_MEMCACHED;
      $wgParserCacheType = CACHE_MEMCACHED;

      # ----- Permissions -----
      # Anonymous users can read but not edit
      $wgGroupPermissions['*']['edit'] = false;
      $wgGroupPermissions['*']['createpage'] = false;
      $wgGroupPermissions['*']['createtalk'] = false;
      $wgGroupPermissions['*']['writeapi'] = false;

      # Registered users can edit after autoconfirm
      $wgGroupPermissions['user']['edit'] = true;
      $wgGroupPermissions['user']['createpage'] = true;
      $wgGroupPermissions['user']['createtalk'] = true;
      $wgGroupPermissions['user']['writeapi'] = true;
      $wgGroupPermissions['user']['upload'] = true;
      $wgGroupPermissions['user']['reupload'] = true;
      $wgGroupPermissions['user']['move'] = true;

      # Autoconfirm: 5 edits + 3 days + email confirmed
      $wgAutoConfirmAge = 3 * 86400;
      $wgAutoConfirmCount = 5;
      $wgEmailConfirmToEdit = true;

      # ----- Uploads -----
      $wgEnableUploads = true;
      $wgFileExtensions = array_merge(
        $wgFileExtensions,
        [ "pdf", "svg", "png", "gif", "jpg", "jpeg", "webp" ]
      );
      $wgMaxUploadSize = 10 * 1024 * 1024; // 10MB
      $wgUseImageMagick = true;
      $wgImageMagickConvertCommand = "${pkgs.imagemagick}/bin/convert";

      # ----- Foreign file repos (Wikimedia Commons) -----
      $wgUseInstantCommons = true;

      # ----- Cookie prefix (must match Caddy session detection) -----
      $wgCookiePrefix = "nb_wiki";

      # ----- Performance -----
      $wgUseGzip = true;
      $wgDiff3 = "${pkgs.diffutils}/bin/diff3";
      $wgJobRunRate = 0; // jobs handled by maintenance script
      $wgResourceLoaderMaxage = [
        'versioned' => 30 * 86400,
        'unversioned' => 300,
      ];

      # ----- Extension configs -----
      # Scribunto (Lua templating)
      $wgScribuntoDefaultEngine = "luastandalone";
      $wgScribuntoEngineConf['luastandalone']['luaPath'] = "${pkgs.lua5_4}/bin/lua";

      # VisualEditor
      $wgVisualEditorEnableWikitext = true;
      $wgDefaultUserOptions['visualeditor-enable'] = 1;

      # ParserFunctions
      $wgPFEnableStringFunctions = true;

      # SpamBlacklist
      $wgSpamBlacklistFiles = [
        "https://meta.wikimedia.org/w/index.php?title=Spam_blacklist&action=raw&sb_ver=1",
      ];

      # SyntaxHighlight
      $wgSyntaxHighlightModels['nix'] = 'nix';

      # Popups (Page Previews)
      $wgPopupsHideOptInOnPreferencesPage = true;
      $wgPopupsOptInDefaultState = "1";
    '';
  };

  age.secrets.mediawiki-secret-key = {
    file = ../secrets/mediawiki-secret-key.age;
    owner = "mediawiki";
    group = "mediawiki";
  };

  age.secrets.mysql-mediawiki = {
    file = ../secrets/mysql-mediawiki.age;
    owner = "mediawiki";
    group = "mediawiki";
  };
}