{ config, containerCfg, pkgs, lib, ... }:
let 
serverCfg = config.syscfg.server;
in {
  paths = [{
    path="${serverCfg.dataPath}/authentik/media";
    owner = "1000:1000";
    mode = "0755";
  }{
    path="${serverCfg.dataPath}/authentik/templates";
    owner = "1000:1000";
    mode = "0755";
  }];

  containers = {

    server = {
      image = "ghcr.io/goauthentik/server:latest";
      volumes = [
        "${serverCfg.dataPath}/authentik/media:/media"
        "${serverCfg.dataPath}/authentik/templates:/templates"
      ];
      environmentFiles = [
        config.sops.secrets."AUTHENTIK".path
      ];
      environment = {
        "AUTHENTIK_REDIS__HOST" = "host.containers.internal";
        "AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
        "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
        "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
        "AUTHENTIK_EMAIL__HOST" = "${serverCfg.mailDomain}";
        "AUTHENTIK_EMAIL__PORT" = "587";
        "AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}";
        "AUTHENTIK_EMAIL__USE_TLS" = "true";
        "AUTHENTIK_EMAIL__USE_SSL" = "false";
        "AUTHENTIK_EMAIL__TIMEOUT" = "10";
        "AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}";
      };
      labels = {
        "traefik.enable" = "true";
        "traefik.http.routers.sso.entrypoints" = "web-secure";
        "traefik.http.routers.sso.rule" = "Host(`sso.${serverCfg.hostDomain}`)";
        "traefik.http.routers.sso.tls" = "true";
        "traefik.http.services.sso.loadbalancer.server.port" = "${toString containerCfg.port}";
      };
      cmd = [ "server" ];
      extraOptions = [
        "--add-host=host.containers.internal:host-gateway"
        "--ip=${containerCfg.ip}"
      ];
      ports = [
        "9999:${toString containerCfg.port}"
      ];
    };

    worker = {
      image = "ghcr.io/goauthentik/server:latest";
      volumes = [
        "${serverCfg.dataPath}/authentik/media:/media"
        "${serverCfg.dataPath}/authentik/templates:/templates"
        "/var/run/docker.sock:/var/run/docker.sock"
      ];
      environmentFiles = [
        config.sops.secrets."AUTHENTIK".path
      ];
      environment = {
        "AUTHENTIK_REDIS__HOST" = "host.containers.internal";
        "AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
        "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
        "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
      };
      extraOptions = [
        "--add-host=host.containers.internal:host-gateway"
      ];
      cmd = [ "worker" ];
    };
  };
}