{ config, containerCfg, pkgs, lib, mkContainer, ... }:
let 
serverCfg = config.syscfg.server;
in {
  paths = [{
    path="${serverCfg.dataPath}/authentik/media";
    owner = "1000:1000";
    mode = "0755";
  }{
    path="${serverCfg.dataPath}/authentik/templates";
    owner = "1000:1000";
    mode = "0755";
  }];

  containers = {

    server = mkContainer {
      subdomain = "sso";
      image = "ghcr.io/goauthentik/server:latest";
      port = containerCfg.port;
      ip = containerCfg.ip;
      secret = "authentik";
      extraEnv = {
        "AUTHENTIK_REDIS__HOST" = mkContainer.host;
        "AUTHENTIK_POSTGRESQL__HOST" = mkContainer.host;
        "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
        "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
        "AUTHENTIK_EMAIL__HOST" = serverCfg.mailDomain;
        "AUTHENTIK_EMAIL__PORT" = "587";
        "AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}";
        "AUTHENTIK_EMAIL__USE_TLS" = "true";
        "AUTHENTIK_EMAIL__USE_SSL" = "false";
        "AUTHENTIK_EMAIL__TIMEOUT" = "10";
        "AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}";
      };

      overrides = {
        cmd = [ "server" ];
        ports = [ "9999:${toString containerCfg.port}" ];
        volumes = [
          "${serverCfg.dataPath}/authentik/media:/media"
          "${serverCfg.dataPath}/authentik/templates:/templates"
        ];
      };
    };

    worker = mkContainer {
      subdomain = "sso";
      image = "ghcr.io/goauthentik/server:latest";
      port = containerCfg.port;
      ip = containerCfg.ip;
      secret = "authentik";
      extraEnv = {
        "AUTHENTIK_REDIS__HOST" = mkContainer.host;
        "AUTHENTIK_POSTGRESQL__HOST" = mkContainer.host;
        "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
        "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
      };

      overrides = {
        cmd = [ "worker" ];
        ports = [ "9999:${toString containerCfg.port}" ];
        volumes = [
          "${serverCfg.dataPath}/authentik/media:/media"
          "${serverCfg.dataPath}/authentik/templates:/templates"
          "/var/run/docker.sock:/var/run/docker.sock"
        ];
      };
    };
  };
}