{ config, lib, inputs, ... }: {

    options.sysconfig.virtualization.authentik.enable = lib.options.mkOption {
        type = lib.types.bool;
        default = false;
    };

    imports = [
        inputs.sops-nix.nixosModules.sops
    ];

    config = lib.mkIf config.sysconfig.virtualization.authentik.enable {

        sops.secrets."authentik/dbpass" = {};

        networking = {

            nat.internalInterfaces = [ "ve-authentik" ];
        };

        containers.authentik = {

            autoStart = true;
            privateNetwork = true;
            hostAddress = "192.168.100.10";
            localAddress = "192.168.100.35";

            extraFlags = [
                "--load-credential=dbpass:${config.sops.secrets."authentik/dbpass".path}"
            ];

            bindMounts = {
                "/etc/authentik" = {
                    hostPath = "/ssd1/Authentik";
                    isReadOnly = false;
                };
            };

            config = {
                
                networking.firewall.allowedTCPPorts = [ 9001 ];

                systemd.services.secrets_setup = {
                    wantedBy = [ "authentik.service" ];

                    serviceConfig = {
                        LoadCredential = [
                            "dbpass"
                        ];
                    };

                    script = ''
                        cat ''${CREDENTIALS_DIRECTORY}/dbpass > /etc/authentik/dbpass
                        chown postgres:postgres /etc/authentik/dbpass
                    '';
                };
                
                services.authentik = {
                    enable = true;

                    environmentFile = "/etc/authentik/authentik.env";

                    settings = {
                        disable_startup_analytics = true;
                        avatars = "initials";
                    };

                    worker.listenHTTP = "0.0.0.0:9001";
                };

                system.stateVersion = "25.05";
            };
        };
    };
}