{
  config,
  lib,
  pkgs,
  ...
}:

let
  EnvironmentFile = [ config.age.secrets.netbox-environment.path ];
  cfg = config.bagel.services.netbox;
  inherit (lib) mkEnableOption mkOption mkIf types;
in

{
  options.bagel.services.netbox = {
    enable = mkEnableOption "Netbox";
    domain = mkOption {
      type = types.str;
    };
  };

  config = mkIf cfg.enable {
    # FIXME: why
    nixpkgs.config.permittedInsecurePackages = [ pkgs.netbox_3_7.name ];

    age.secrets.netbox-environment.file = ../../secrets/floral/netbox-environment.age;
    services = {
      netbox = {
        enable = true;
        package = pkgs.netbox_3_7;
        secretKeyFile = "/dev/null";
        listenAddress = "127.0.0.1";
        settings = {
          ALLOWED_HOSTS = [ cfg.domain ];
          REMOTE_AUTH_BACKEND = "social_core.backends.open_id_connect.OpenIdConnectAuth";
        };

        extraConfig = lib.mkForce ''
          from os import environ as env

          SECRET_KEY = env["SECRET_KEY"]

          SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = env["NETBOX_OIDC_URL"]
          SOCIAL_AUTH_OIDC_KEY = env["NETBOX_OIDC_KEY"]
          SOCIAL_AUTH_OIDC_SECRET = env["NETBOX_OIDC_SECRET"]
        '';
      };

      nginx = {
        enable = true;
        virtualHosts."${cfg.domain}" = {
          enableACME = true;
          forceSSL = true;

          locations."/".proxyPass = "http://${config.services.netbox.listenAddress}:${builtins.toString config.services.netbox.port}";
          locations."/static/".alias = "${config.services.netbox.dataDir}/static/";
        };
      };
    };

    systemd.services = {
      netbox.serviceConfig = {
        inherit EnvironmentFile;

        TimeoutStartSec = 600;
      };

      netbox-housekeeping.serviceConfig = {
        inherit EnvironmentFile;
      };

      netbox-rq.serviceConfig = {
        inherit EnvironmentFile;
      };
    };

    users.users.nginx.extraGroups = [ "netbox" ];
    networking.firewall.allowedTCPPorts = [
      443
      80
    ];
  };
}