self: {
  pkgs,
  lib,
  config,
  ...
}:
with lib; {
  options.services.regalade = {
    enable = mkEnableOption "regalade, a recipe manager";

    package = mkOption {
      type = types.package;
      default = self.packages.${config.nixpkgs.system}.server;
    };

    apiPort = mkOption {
      type = types.port;
      default = 8085;
    };

    user = mkOption {
      type = types.str;
      default = "regalade";
    };

    environmentFile = mkOption {
      type = types.nullOr types.path;
      default = null;
    };

    frontend = {
      enable = mkEnableOption "the frontend for regalade";

      package = mkOption {
        type = types.package;
        default = self.packages.${config.nixpkgs.system}.frontend;
      };
    };
  };

  config = let
    cfg = config.services.regalade;
  in
    mkIf cfg.enable {
      systemd.services.regalade = {
        description = "regalade";
        after = ["network.target" "postgresql.service"];
        wantedBy = ["multi-user.target"];

        serviceConfig = {
          Type = "simple";
          User = cfg.user;
          ExecStart = "${cfg.package}/bin/regalade";
          EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
          # Security
          NoNewPrivileges = true;
          # Sandboxing
          ProtectSystem = "strict";
          ProtectHome = true;
          PrivateTmp = true;
          PrivateDevices = true;
          PrivateUsers = true;
          ProtectHostname = true;
          ProtectClock = true;
          ProtectKernelTunables = true;
          ProtectKernelModules = true;
          ProtectKernelLogs = true;
          ProtectControlGroups = true;
          RestrictAddressFamilies = ["AF_UNIX AF_INET AF_INET6"];
          LockPersonality = true;
          MemoryDenyWriteExecute = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          PrivateMounts = true;
        };

        environment = {
          REGALADE_DATABASE_URL = "postgres://${cfg.user}/regalade?host=/var/run/postgresql";
        };
      };

      services.postgresql = {
        ensureUsers = [
          {
            name = cfg.user;
            ensurePermissions = {"DATABASE \"regalade\"" = "ALL PRIVILEGES";};
          }
        ];
        ensureDatabases = ["regalade"];
      };

      users = mkIf (cfg.user == "regalade") {
        users.regalade = {
          description = "Regalade API server";
          group = "regalade";
          isSystemUser = true;
        };
        groups.regalade = {};
      };
    };
}