{
  config,
  lib,
  ...
}:
let
  guestCfg = config.guests.navidrome;
  serviceCfg = config.containers.navidrome.config.modules.services.navidrome;
in
{
  options.guests.navidrome = {
    dataPath = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = "/srv/navidrome";
      description = "Host path mounted as Navidrome's data folder.";
    };

    libraryPath = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = "/srv/music";
      description = "Host path mounted as Navidrome's library folder.";
    };

    lastfmApiKeySecret = lib.mkOption {
      type = lib.types.str;
      default = "services/navidrome/lastfm/api-key";
      description = "SOPS secret name containing the Navidrome Last.fm API key.";
    };

    lastfmSecretSecret = lib.mkOption {
      type = lib.types.str;
      default = "services/navidrome/lastfm/secret";
      description = "SOPS secret name containing the Navidrome Last.fm secret.";
    };
  };

  config = lib.mkIf guestCfg.enable {
    assertions = [
      {
        assertion = guestCfg.dataPath != null;
        message = "guests.navidrome.dataPath must point at the host directory that stores Navidrome data.";
      }
      {
        assertion = guestCfg.libraryPath != null;
        message = "guests.navidrome.libraryPath must point at the host directory that stores Navidrome's library folder.";
      }
    ];

    guests.navidrome = {
      interior.modules.services.navidrome.enable = true;

      mounts = {
        ${serviceCfg.dataFolder} = {
          directory = guestCfg.dataPath;
          owner = config.registry."stable-uid".${config.networking.hostName}.navidrome;
          group = "storage";
          mode = "2770";
        };
        ${serviceCfg.musicFolder} = {
          directory = guestCfg.libraryPath;
          owner = "root";
          group = "storage";
          mode = "2770";
        };
        ${serviceCfg.environmentFile} = {
          file = config.sops.templates."navidrome.env".path;
          readOnly = true;
        };
      };

      limits = {
        memory = lib.mkDefault "2G";
        cpu = lib.mkDefault "200%";
        tasksMax = lib.mkDefault 512;
      };
    };

    sops.secrets = {
      ${guestCfg.lastfmApiKeySecret}.sopsFile = ../secrets + "/${config.networking.hostName}.yaml";
      ${guestCfg.lastfmSecretSecret}.sopsFile = ../secrets + "/${config.networking.hostName}.yaml";
    };

    sops.templates."navidrome.env" = {
      owner = "root";
      group = "storage";
      mode = "0440";
      content = ''
        ND_LASTFM_APIKEY=${config.sops.placeholder.${guestCfg.lastfmApiKeySecret}}
        ND_LASTFM_SECRET=${config.sops.placeholder.${guestCfg.lastfmSecretSecret}}
      '';
    };
  };
}