{
  config,
  lib,
  pkgs,
  ...
}:
let
  configScript = pkgs.writeShellScript "navidrome-config" ''
    set -eu

    umask 077
    api_key="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/lastfm-api-key")"
    secret="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/lastfm-secret")"

    cat > /run/navidrome/navidrome.toml <<EOF
    Address = "0.0.0.0"
    Port = 4533
    DataFolder = "${config.modules.services.navidrome.dataDir}"
    MusicFolder = "${config.modules.services.navidrome.libraryDir}"
    EnableSharing = true
    LastFM.ApiKey = "$api_key"
    LastFM.Secret = "$secret"
    EOF
  '';
in
{
  options.modules.services.navidrome = {
    enable = lib.mkEnableOption "Navidrome";

    dataDir = lib.mkOption {
      type = lib.types.str;
      default = "/var/lib/navidrome";
      readOnly = true;
      description = "Guest path where Navidrome stores its data folder.";
    };

    libraryDir = lib.mkOption {
      type = lib.types.str;
      default = "/music";
      readOnly = true;
      description = "Guest path where Navidrome reads its library folder.";
    };

    lastfmApiKeyFile = lib.mkOption {
      type = lib.types.path;
      description = "Runtime file containing the Navidrome Last.fm API key.";
    };

    lastfmSecretFile = lib.mkOption {
      type = lib.types.path;
      description = "Runtime file containing the Navidrome Last.fm secret.";
    };
  };

  config = lib.mkMerge [
    {
      registry."stable-uid".${config.networking.hostName}.navidrome = 20004;
    }

    (lib.mkIf config.modules.services.navidrome.enable {
      users.users.navidrome = {
        isSystemUser = true;
        uid = config.registry."stable-uid".${config.networking.hostName}.navidrome;
        group = "storage";
        home = config.modules.services.navidrome.dataDir;
      };

      systemd.services.navidrome = {
        description = "Navidrome media server";
        after = [ "network.target" ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          Type = "simple";
          User = "navidrome";
          Group = "storage";
          WorkingDirectory = config.modules.services.navidrome.dataDir;
          StateDirectory = "navidrome";
          RuntimeDirectory = "navidrome";
          RuntimeDirectoryMode = "0700";
          LoadCredential = [
            "lastfm-api-key:${config.modules.services.navidrome.lastfmApiKeyFile}"
            "lastfm-secret:${config.modules.services.navidrome.lastfmSecretFile}"
          ];
          ExecStartPre = configScript;
          ExecStart = "${lib.getExe pkgs.navidrome} --configfile /run/navidrome/navidrome.toml";
          Restart = "on-failure";
          NoNewPrivileges = true;
          PrivateTmp = true;
        };
      };

      networking.firewall.allowedTCPPorts = [ 4533 ];
    })
  ];
}