self: {
  pkgs,
  lib,
  config,
  options,
  ...
}:
with lib; {
  options.services.regalade = {
    enable = mkEnableOption "regalade, a recipe manager";

    package = mkOption {
      type = types.package;
      default = self.packages.${config.nixpkgs.system}.server;
    };

    settings = {
      jwtSecret = mkOption {
        type = types.nullOr types.str;
        default = null;
        description = ''
          The JWT secret to be used by the application. Should be passed through environmentFile,
          with REGALADE_JWT_SECRET.
        '';
      };

      host = mkOption {
        type = types.str;
        default = "0.0.0.0";
        description = "The listen address";
      };

      port = mkOption {
        type = types.port;
        default = 8085;
      };

      apiAllowed = mkOption {
        type = types.nullOr types.str;
        default = null;
        description = "The CORS Access-Control-Allow-Origin value";
      };

      databaseUrl = mkOption {
        type = types.str;
        default = "postgres://${config.services.regalade.user}/regalade?host=/var/run/postgresql";
      };

      sqlxLogging = mkEnableOption "logging of all SQL operations";

      oidc = {
        enable = mkEnableOption "authentication using an OIDC provider";

        url = mkOption {
          type = types.str;
          description = "The base URL of the provider (directory where the .well-known is)";
        };

        id = mkOption {
          type = types.str;
          description = "Client ID";
        };

        secret = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = "The environment variable REGALADE_OIDC__SECRET should be preferred";
        };

        scopes = mkOption {
          type = types.listOf types.str;
          default = ["openid" "profile" "email"];
        };

        domain = mkOption {
          type = types.str;
          description = "URL at which to redirect, where the application is deployed";
        };
      };
    };

    user = mkOption {
      type = types.str;
      default = "regalade";
    };

    environmentFile = mkOption {
      type = types.nullOr types.path;
      default = null;
    };

    frontend = {
      enable = mkEnableOption "the frontend for regalade";

      package = mkOption {
        type = types.package;
        default = self.packages.${config.nixpkgs.system}.frontend;
      };
    };
  };

  config = let
    cfg = config.services.regalade;
  in
    mkIf cfg.enable {
      systemd.services.regalade = {
        description = "regalade";
        after = ["network.target" "postgresql.service"];
        wantedBy = ["multi-user.target"];

        serviceConfig = {
          Type = "simple";
          User = cfg.user;
          ExecStart = "${cfg.package}/bin/regalade";
          EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
          # Security
          NoNewPrivileges = true;
          # Sandboxing
          ProtectSystem = "strict";
          ProtectHome = true;
          PrivateTmp = true;
          PrivateDevices = true;
          PrivateUsers = true;
          ProtectHostname = true;
          ProtectClock = true;
          ProtectKernelTunables = true;
          ProtectKernelModules = true;
          ProtectKernelLogs = true;
          ProtectControlGroups = true;
          RestrictAddressFamilies = ["AF_UNIX AF_INET AF_INET6"];
          LockPersonality = true;
          MemoryDenyWriteExecute = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          PrivateMounts = true;
        };

        environment =
          {
            REGALADE_DATABASE_URL = cfg.settings.databaseUrl;
            REGALADE_JWT_SECRET = cfg.settings.jwtSecret;
            REGALADE_HOST = cfg.settings.host;
            REGALADE_PORT = toString cfg.settings.port;
            REGALADE_API_ALLOWED = cfg.settings.apiAllowed;
            REGALADE_SQLX_LOGGING =
              if cfg.settings.sqlxLogging
              then "true"
              else "false";
          }
          // (
            if cfg.settings.oidc.enable
            then let
              inherit (cfg.settings) oidc;
            in {
              REGALADE_OIDC__URL = oidc.url;
              REGALADE_OIDC__ID = oidc.id;
              REGALADE_OIDC__SECRET = oidc.secret;
              REGALADE_OIDC__DOMAIN = oidc.domain;
              REGALADE_OIDC__SCOPES = lib.strings.concatStringsSep "," oidc.scopes;
            }
            else {}
          );
      };

      services.postgresql =
        mkIf (cfg.settings.databaseUrl == options.services.regalade.settings.databaseUrl.default)
        {
          ensureUsers = [
            {
              name = cfg.user;
              ensurePermissions = {"DATABASE \"regalade\"" = "ALL PRIVILEGES";};
            }
          ];
          ensureDatabases = ["regalade"];
        };

      users = mkIf (cfg.user == "regalade") {
        users.regalade = {
          description = "Regalade API server";
          group = "regalade";
          isSystemUser = true;
        };
        groups.regalade = {};
      };
    };
}