{ config, containerCfg, pkgs, lib, builder, name,... }:
let 
  version = "v2";
  serverCfg = config.syscfg.server;

in {
  sops = true;
  db = true;

  paths = [{
    path = "${serverCfg.configPath}/immich/cache";
    mode = "0750";
  }{
    path = "${serverCfg.dataPath}/immich/";
    owner = "1000:1000";
    mode = "0755";
  }];

  containers = {
    server = builder.mkContainer {
      subdomain = containerCfg.subdomain;
      image = "ghcr.io/immich-app/immich-server:${version}";
      port = 2283;
      secret = name;
      extraEnv = {
        DB_HOSTNAME = builder.host;
        REDIS_HOSTNAME = builder.host;
        DB_USERNAME = "immich_user";
        DB_DATABASE_NAME = "immich_db";
        IMMICH_TRUSTED_PROXIES = "10.0.0.0/8";
        IMMICH_ALLOW_SETUP = "false";
        IMMICH_MACHINE_LEARNING_URL = "http://immich-ml:3003";
        IMMICH_IGNORE_MOUNT_CHECK_ERRORS = "true";
      };
      overrides = {
        volumes = [
          "${serverCfg.dataPath}/immich:/data"
        ];
      };
    };

    ml = builder.mkContainer {
      image = "ghcr.io/immich-app/immich-machine-learning:${version}";
      port = 3003;
      overrides = {
        volumes = [
          "${serverCfg.configPath}/immich/cache:/cache"
        ];
      };
    };
  };

  setup = {
    trigger = "server";
    envFile = config.sops.secrets."CUSTOM".path;
    script = pkgs.writeShellScript "setup" ''
        PSQL="${pkgs.postgresql}/bin/psql -U postgres"
        $PSQL -d "immich_db" -tAc "CREATE EXTENSION IF NOT EXISTS vchord CASCADE;"
        $PSQL -d "immich_db" -tAc "CREATE EXTENSION IF NOT EXISTS earthdistance CASCADE;"

        IMMICH_URL=http://immich-server:2283
        until [[ "$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$IMMICH_URL")" =~ (200|301|302) ]]; do
          sleep 5
        done
        ${pkgs.curl}/bin/curl -X POST "$IMMICH_URL/api/admin/users" \
        -H "Content-Type: application/json" \
        -H "Accept: application/json" \
        -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "name": "'"$DEFAULT_ADMIN_USERNAME"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'" }'
    '';
  };
}