{
  config,
  pkgs,
  lib,
  ...
}:

{
  # Worker plumbing examples: https://github.com/element-hq/synapse/blob/master/docker/configure_workers_and_start.py
  # Documentation: https://github.com/element-hq/synapse/blob/develop/docs/workers.md
  imports = [ ./workers/module.nix ];

  services.matrix-synapse = {
    enable = true;
    withJemalloc = true;

    nginxVirtualHostName = "matrix.rory.gay";
    federationSenders = 16;
    pushers = 1;
    mediaRepoWorkers = 4;
    clientReaders = 4;
    syncWorkers = 4;

    federationReaders = 8;
    federationInboundWorkers = 8;

    enableAppserviceWorker = true;
    enableBackgroundWorker = true;
    enableUserDirWorker = true;

    enableStreamWriters = false;
    #eventStreamWriters = 8;

    # https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html
    settings = {
      server_name = "rory.gay";

      enable_registration = true;
      registration_requires_token = true;

      require_membership_for_aliases = false;
      redaction_retention_period = null;
      user_ips_max_age = null;
      allow_device_name_lookup_over_federation = true;

      federation = {
        client_timeout = "60s";
        max_short_retries = 12;
        max_short_retry_delay = "5s";
        max_long_retries = 5;
        max_long_retry_delay = "30s";
      };

      registration_shared_secret_path = "/var/lib/matrix-synapse/registration_shared_secret.txt";

      listeners = [
        {
          port = 8008;
          bind_addresses = [
            "192.168.1.2"
            "127.0.0.1"
          ];
          type = "http";
          tls = false;
          x_forwarded = true;
          resources = [
            {
              names = [
                "client"
                "federation"
              ];
              compress = false;
            }
          ];
        }
        {
          type = "http";
          path = "/run/matrix-synapse/main.sock";
          resources = [
            {
              names = [ "replication" ];
              compress = false;
            }
          ];
        }
      ];
      dynamic_thumbnails = true;
      presence = {
        enable = true;
        update_interval = 60;
      };
      url_preview_enabled = true;
      database = (
        import ./db.nix {
          workerName = "main";
          dbGroup = "medium";
        }
      );
      app_service_config_files = [
        #"/etc/matrix-synapse/appservice-registration.yaml"
        "/var/lib/matrix-synapse/modas-registration.yaml"
      ];

      max_image_pixels = "250M";

      ui_auth = {
        session_timeout = "1m";
      };

      login_via_existing_session = {
        enabled = true;
        require_ui_auth = true;
        token_timeout = "1y";
      };

      report_stats = false;

      user_directory = {
        enabled = true;
        search_all_users = true;
        prefer_local_users = true;
      };

      # https://github.com/element-hq/synapse/blob/master/synapse/config/experimental.py
      experimental_features = {
        "msc2815_enabled" = true; # Redacted event content
        "msc3026_enabled" = true; # Busy presence
        "msc3266_enabled" = true; # Room summary API
        "msc3916_authenticated_media_enabled" = true; # Authenticated media
      };

      redis = {
        enabled = true;
        path = "/run/redis-matrix-synapse/redis.sock";
      };

      instance_map = {
        main = {
          # replication listener
          path = "/run/matrix-synapse/main.sock";
        };
      };
    } // import ./ratelimits.nix // import ./caches.nix;
  };

  systemd.services.matrix-synapse-reg-token = {
    description = "Random registration token for Synapse.";
    before = [ "matrix-synapse.service" ]; # So the registration can be used by Synapse
    wantedBy = [ "multi-user.target" ];
    after = [ "network.target" ];

    script = ''

      if [ ! -f "registration_shared_secret.txt" ]
      then
        cat /dev/urandom | tr -dc a-zA-Z0-9 | fold -w 256 | head -n 1 > registration_shared_secret.txt
      else
        echo Not generating key, key exists;
      fi'';
    serviceConfig = {
      User = "matrix-synapse";
      Group = "matrix-synapse";
      WorkingDirectory = "/var/lib/matrix-synapse";
    };
  };

  services.redis = {
    package = pkgs.keydb;
    servers.matrix-synapse = {
      enable = true;
      user = "matrix-synapse";
    };
  };

  systemd.tmpfiles.rules = [ "D /run/redis-matrix-synapse 0755 matrix-synapse matrix-synapse" ];
}