{ config, pkgs, ...}:
let
  user = config.yoda.user;

  name = "notify-change";
  subdir = "readonly-git/notify-change";
  fulldir = "/home/${user}/${subdir}";

  jdk = pkgs.jdk23;
  gradle = pkgs.gradle.override {
    java = jdk;
    javaToolchains = [ jdk ];
  };
in
{
  # /secrets/"${name}-EMAIL_RECIPIENTS"
  deployment.keys."${name}-EMAIL_RECIPIENTS" = {
    # comma-separated list of email addresses
    keyFile = ../../secrets/${name}-email-recipients;
    destDir = "/secrets";
    user = "${user}";
    #group = "smtpd"; # Default: root
    permissions = "0400";
    uploadAt = "pre-activation";
  };
  # /secrets/"${name}-EMAIL_USER"
  deployment.keys."${name}-EMAIL_USER" = {
    keyFile = ../../secrets/user.web.de;
    destDir = "/secrets";
    user = "${user}";
    #group = "smtpd"; # Default: root
    permissions = "0400";
    uploadAt = "pre-activation";
  };
  # /secrets/"${name}-EMAIL_PASSWORD"
  deployment.keys."${name}-EMAIL_PASSWORD" = {
    keyFile = ../../secrets/pwd.web.de;
    destDir = "/secrets";
    user = "${user}";
    #group = "smtpd"; # Default: root
    permissions = "0400";
    uploadAt = "pre-activation";
  };
  # /secrets/"${name}-ILIAS_USER"
  deployment.keys."${name}-ILIAS_USER" = {
    keyFile = ../../secrets/user.ilias.uni-marburg.de;
    destDir = "/secrets";
    user = "${user}";
    #group = "smtpd"; # Default: root
    permissions = "0400";
    uploadAt = "pre-activation";
  };
  # /secrets/"${name}-ILIAS_PASSWORD"
  deployment.keys."${name}-ILIAS_PASSWORD" = {
    keyFile = ../../secrets/pwd.ilias.uni-marburg.de;
    destDir = "/secrets";
    user = "${user}";
    #group = "smtpd"; # Default: root
    permissions = "0400";
    uploadAt = "pre-activation";
  };

  # Download notify-change Git repository.
#  home-manager.users."${user}" = { osConfig, config, pkgs, ... }: {
#    home.file."${subdir}".source = (builtins.fetchGit {
#      url = "https://codeberg.org/privacy1st/selenium-webdriver-ide-demo";
#      ref = "changedetection";
#      #leaveDotGit = true;
#    });
#  };

  # TODO: Properly build gradle project with nix instead of systemd service script "git pull & gradle build"

  # Run service once per day.
  systemd.timers."${name}" = {
    wantedBy = [ "timers.target" ];
    partOf = [ "${name}.service" ];
    timerConfig = {
      OnBootSec = "0m";
      OnUnitInactiveSec = "1d";

      AccuracySec = "5m";
      RandomizedDelaySec = "5m";
    };
  };
  # Service definition.
  systemd.services."${name}" = {
    description = "Send notification on website change";
    serviceConfig = {
      Type = "oneshot";
      PrivateTmp = true;
      User = "${user}";
    };
    path = [
      pkgs.bash # todo
      pkgs.git
      jdk
      gradle
      pkgs.firefox
    ];
    script = ''
      set -eu -o pipefail

      TESSERACT_LIB="${pkgs.tesseract}/lib"
      TESSDATA_PREFIX="${pkgs.tesseract}/share/tessdata"

      if test -d "${fulldir}"; then
        cd "${fulldir}"
        git pull
      else
        git clone --branch changedetection --single-branch https://codeberg.org/privacy1st/selenium-webdriver-ide-demo.git "${fulldir}"
        cd "${fulldir}"
      fi

      # --rerun: Execute test again even if code did not change
      gradle :app:test --tests "de.p1st.changedetection.IliasFB12CoursesTest" --rerun
    '';
  };
}