{ config, lib, ... }: {

    options.sysconfig.opts.virtualization.keycloak.enable = lib.options.mkOption {
        type = lib.types.bool;
        default = false;
    };

    config = lib.mkIf config.sysconfig.opts.virtualization.keycloak.enable {

        containers.keycloak = {

            autoStart = true;
            privateNetwork = true;
            hostAddress = "192.168.100.10";
            localAddress = "192.168.100.22";

            extraFlags = [
                "--load-credential=dbpass:${config.sops.secrets."keycloak/dbpass".path}"
            ];

            bindMounts = {
                "/etc/keycloak" = {
                    hostPath = "/ssd1/Keycloak";
                    isReadOnly = false;
                };
            };

            config = {

                systemd.services.secrets_setup = {
                    wantedBy = [ "keycloak.service" ];

                    serviceConfig = {
                        LoadCredential = [
                            "dbpass"
                        ];
                    };

                    script = ''
                        cat ''${CREDENTIALS_DIRECTORY}/dbpass > /etc/keycloak/dbpass
                        chown keycloak:keycloak /etc/keycloak/*
                    '';
                };
                
                services.keycloak = {
                    
                    enable = true;

                    settings = {
                        hostname = "auth.blunkall.us";
                    };
                };

                system.stateVersion = "25.05";
            };
        };
    };
}