{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.bagel.services.hookshot;
  inherit (lib) mkEnableOption mkIf mkOption types;
  keyPath = "/var/lib/matrix-hookshot/key.pem";
in
{
  options.bagel.services.hookshot = {
    enable = mkEnableOption "matrix-hookshot";
    settings = mkOption {
      description = "Settings";
      type = (pkgs.formats.yaml { }).type;
    };
    admins = mkOption {
      description = "List of admin MXIDs";
      type = types.listOf types.str;
    };
  };

  config = mkIf cfg.enable {
    systemd.services.matrix-hookshot = {
      wantedBy = ["multi-user.target"];
      wants = ["network-online.target"];
      after = ["network-online.target"];
      serviceConfig = {
        ExecStart = "${lib.getExe pkgs.matrix-hookshot} ${pkgs.writers.writeYAML "config.yaml" cfg.settings}";
        ExecStartPre = pkgs.writeShellScript "hookshot-generate-key" ''
          if [ ! -f ${keyPath} ]; then
            mkdir -p $(dirname ${keyPath})
            ${lib.getExe pkgs.openssl} genpkey -out ${keyPath} -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096
          fi
        '';
        DynamicUser = true;
        StateDirectory = "matrix-hookshot";
        WorkingDirectory = "/var/lib/matrix-hookshot";
      };
    };

    bagel.services.hookshot.settings = {
      bridge = {
        domain = "forkos.org";
        url = "https://matrix.forkos.org";
        mediaUrl = "https://forkos.org";
        port = 9993;
        bindAddress = "127.0.0.1";
      };
      passFile = keyPath;
      listeners = [{
        port = 9994;
        bindAddress = "127.0.0.1";
        resources = [ "webhooks" ];
      }];
      generic = {
        enabled = true;
        urlPrefix = "https://alerts.forkos.org/webhook";
      };
      permissions = map (mxid: {
        actor = mxid;
        services = [{
          service = "*";
          level = "admin";
        }];
      }) cfg.admins;
    };

    services.nginx.virtualHosts."alerts.forkos.org" = {
      forceSSL = true;
      enableACME = true;
      locations."/".proxyPass = "http://127.0.0.1:9994";
    };
  };
}