{
  config,
  lib,
  ...
}:
let
  cfg = config.modules.services.actualbudget; # NOLINT(let_order)
in
{
  options.modules.services.actualbudget = {
    enable = lib.mkEnableOption "Actual Budget";

    port = lib.mkOption {
      type = lib.types.port;
      default = 5006;
      description = "Port Actual Budget listens on.";
    };

    dataDir = lib.mkOption {
      type = lib.types.str;
      default = "/data";
      description = "Directory where Actual Budget stores server and user files.";
    };

    user = lib.mkOption {
      type = lib.types.str;
      default = "actual";
      description = "User account that runs Actual Budget.";
    };

    group = lib.mkOption {
      type = lib.types.str;
      default = "storage";
      description = "Group account that owns Actual Budget's writable state.";
    };

  };

  config = lib.mkMerge [
    {
      registry."stable-uid".${config.networking.hostName}.actualbudget = 20001;
    }

    (lib.mkIf cfg.enable {
      users.users.${cfg.user} = {
        isSystemUser = true;
        uid = config.registry."stable-uid".${config.networking.hostName}.actualbudget;
        inherit (cfg) group;
      };

      services.actual = {
        enable = true;
        openFirewall = true;
        inherit (cfg) user;
        inherit (cfg) group;
        settings = {
          inherit (cfg) port dataDir;
        };
      };
    })
  ];
}