{ config, lib, inputs, ... }: {

    options.sysconfig.opts.virtualization.keycloak.enable = lib.options.mkOption {
        type = lib.types.bool;
        default = false;
    };

    imports = [
        inputs.sops-nix.nixosModules.sops
    ];

    config = lib.mkIf config.sysconfig.opts.virtualization.keycloak.enable {

        sops.secrets."keycloak/dbpass" = {};

        networking = {

            nat.internalInterfaces = [ "ve-keycloak" ];
        };

        containers.keycloak = {

            autoStart = true;
            privateNetwork = true;
            hostAddress = "192.168.100.10";
            localAddress = "192.168.100.22";

            extraFlags = [
                "--load-credential=dbpass:${config.sops.secrets."keycloak/dbpass".path}"
            ];

            bindMounts = {
                "/etc/keycloak" = {
                    hostPath = "/ssd1/Keycloak";
                    isReadOnly = false;
                };
            };

            config = {
                
                networking.firewall.allowedTCPPorts = [ 80 ];

                systemd.services.secrets_setup = {
                    wantedBy = [ "keycloak.service" ];

                    serviceConfig = {
                        LoadCredential = [
                            "dbpass"
                        ];
                    };

                    script = ''
                        cat ''${CREDENTIALS_DIRECTORY}/dbpass > /etc/keycloak/dbpass
                        chown postgres:postgres /etc/keycloak/dbpass
                    '';
                };
                
                services.keycloak = {
                    
                    enable = true;

                    database.passwordFile = "/etc/keycloak/dbpass";

                    settings = {
                        hostname = "auth.blunkall.us";

                        http-enabled = true;

                        proxy-headers = "xforwarded";

                        proxy-trusted-addresses = "192.168.100.11";
                    };

                    initialAdminPassword = "7567";
                };

                system.stateVersion = "25.05";
            };
        };
    };
}