{ config, ... }:
{
  config = {
    services.postgresql = {
      ensureDatabases = [ "firefly-iii" ];
      ensureUsers = [
        { name = "firefly-iii";
          ensureDBOwnership = true;
        }
      ];
    };

    services.firefly-iii = {
      enable = true;
      enableNginx = true;
      group = "firefly-iii";
      virtualHost = "firefly.yggdrasil.li";
      settings = {
        DB_CONNECTION = "pgsql";
        DB_DATABASE = "firefly-iii";
        APP_KEY_FILE = config.sops.secrets."firefly-iii_app_key".path;
        APP_URL = "https://${config.services.firefly-iii.virtualHost}";
      };
    };

    services.nginx = {
      commonHttpConfig = ''
        map $http_x_forwarded_proto $fastcgi_param_https_variable {
            default ''';
            https 'on';
        }
      '';
      virtualHosts.${config.services.firefly-iii.virtualHost} = {
        listen = [
          { addr = "[2a03:4000:52:ada:4:1::]"; port = 9000; }
        ];
        extraConfig = ''
          set_real_ip_from 2a03:4000:52:ada:4::;
        '';
        locations."~ \\.php$" = {
          extraConfig = ''
            fastcgi_param HTTPS $fastcgi_param_https_variable;
          '';
        };
      };
    };

    sops.secrets."firefly-iii_app_key" = {
      format = "binary";
      sopsFile = ./app_key;
      group = config.services.firefly-iii.group;
      mode = "0440";
      restartUnits = [ "firefly-iii-setup.service" "firefly-iii-cron.service" "phpfpm-firefly-iii.service" ];
    };

    users.groups.${config.services.firefly-iii.group} = {};

    systemd.services = {
      nginx.serviceConfig.SupplementaryGroups = [ config.services.firefly-iii.group ];
      "firefly-iii-setup".serviceConfig.ReadWritePaths = [ "/run/postgresql" ];
      "firefly-iii-cron".serviceConfig.ReadWritePaths = [ "/run/postgresql" ];
    };
  };
}