{
  config,
  lib,
  ...
}:
let
  cfg = config.guests.valheim;
  steamDir = "/data/steamcmd";
  installDir = "/data/server";
  stateDir = "/data/state";
in
{
  options.guests.valheim = {
    steamPath = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = "/srv/steamcmd";
      description = "Host path bind-mounted as SteamCMD's metadata directory.";
    };

    installPath = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = "/srv/valheim/server";
      description = "Host path bind-mounted as Valheim's server install directory.";
    };

    statePath = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = "/srv/valheim/state";
      description = "Host path bind-mounted as Valheim's world state directory.";
    };

    serverName = lib.mkOption {
      type = lib.types.str;
      default = "valheim";
      description = "Name shown for the Valheim server.";
    };

    port = lib.mkOption {
      type = lib.types.port;
      default = 2456;
      description = "Base UDP port for the Valheim server.";
    };

    passwordSecret = lib.mkOption {
      type = lib.types.str;
      default = "services/game-servers/password";
      description = "SOPS secret name containing the Valheim server password.";
    };
  };

  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = cfg.steamPath != null;
        message = "guests.valheim.steamPath must point at the host directory that stores SteamCMD metadata.";
      }
      {
        assertion = cfg.installPath != null;
        message = "guests.valheim.installPath must point at the host directory that stores Valheim server files.";
      }
      {
        assertion = cfg.statePath != null;
        message = "guests.valheim.statePath must point at the host directory that stores Valheim world state.";
      }
    ];

    guests.valheim = {
      interior.modules.services.games.valheim = {
        enable = true;
        inherit (cfg) serverName port;
        inherit steamDir installDir stateDir;
        passwordFile = "/run/secrets/${cfg.passwordSecret}";
      };

      mounts = {
        ${steamDir} = {
          directory = cfg.steamPath;
          owner = config.registry."stable-uid".${config.networking.hostName}.steamcmd;
          group = "storage";
          mode = "0770";
        };
        ${installDir} = {
          directory = cfg.installPath;
          owner = config.registry."stable-uid".${config.networking.hostName}.steamcmd;
          group = "storage";
          mode = "0770";
        };
        ${stateDir} = {
          directory = cfg.statePath;
          owner = config.registry."stable-uid".${config.networking.hostName}.steamcmd;
          group = "storage";
          mode = "0770";
        };
        ${"/run/secrets/${cfg.passwordSecret}"} = {
          file = config.sops.secrets.${cfg.passwordSecret}.path;
          readOnly = true;
        };
      };

      limits = {
        memory = lib.mkDefault "4G";
        cpu = lib.mkDefault "400%";
        tasksMax = lib.mkDefault 1024;
      };
    };

    sops.secrets.${cfg.passwordSecret} = {
      owner = "root";
      group = "storage";
      mode = "0440";
    };
  };
}