{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.modules.services.romm;
in
{
  options.modules.services.romm = {
    enable = lib.mkEnableOption "RomM";

    environmentFile = lib.mkOption {
      type = lib.types.path;
      default = "/run/secrets/romm.env";
      readOnly = true;
      description = "Path to RomM's environment file.";
    };
  };

  config = lib.mkMerge [
    {
      registry."stable-uid".${config.networking.hostName} = {
        romm = 20005;
        "redis-romm" = 20006;
      };
    }

    (lib.mkIf cfg.enable {
      networking.firewall.allowedTCPPorts = [ 80 ];

      services.romm = {
        enable = true;
        package = pkgs.alexion.romm;
        group = "storage";
        database.createLocally = true;
        redis.createLocally = true;
        watcher.enable = true;
        extraEnvironment = {
          HASHEOUS_API_ENABLED = "true";
          ROM_CONVERTO_ENABLED = "false";
        };
        inherit (cfg) environmentFile;
      };

      systemd.services.romm-worker.serviceConfig.ExecStart =
        lib.mkForce "${lib.getExe' config.services.romm.package "romm-worker"} scans";

      systemd.tmpfiles.settings."10-romm"."${config.services.romm.dataDir}/config/config.yml"."L+".argument =
        toString (
          (pkgs.formats.yaml { }).generate "romm-config.yml" {
            emulatorjs.auto_save_sync = false;
            filesystem.structure = {
              default = "roms/{platform}/{game}";
              firmware = "bios/{platform}";
            };
          }
        );

      users.users = {
        romm.uid = config.registry."stable-uid".${config.networking.hostName}.romm;
        redis-romm.uid = config.registry."stable-uid".${config.networking.hostName}."redis-romm";
      };
    })
  ];
}