{
  config,
  lib,
  my,
  ...
}:
let
  cfg = config.guests.copyparty;
  accountName = "alexion";
  passwordSecret = "services/copyparty/users/alexion/password";
  serviceUid = my.serviceUid "copyparty";
  stateDir = "/var/lib/copyparty";
  inboxDir = "/srv/inbox";
  mediaDir = "/srv/media";
in
{
  imports = [
    (my.guest {
      name = "copyparty";
      interior = {
        modules.services.copyparty = {
          enable = true;
          inherit accountName stateDir;
          passwordFile = "/run/secrets/${passwordSecret}";
          volumes = {
            "/inbox" = {
              path = inboxDir;
              access.A = [ accountName ];
              flags = [
                "d2d"
                "d2t"
                "dthumb"
              ];
            };
            "/media" = {
              path = mediaDir;
              access.A = [ accountName ];
              flags = [
                "d2d"
                "d2t"
                "dthumb"
              ];
            };
          };
        };
      };
    })
  ];

  options.guests.copyparty = {
    statePath = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = "/srv/copyparty";
      description = "Host path bind-mounted as Copyparty's state directory.";
    };

    inboxPath = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = "/srv/inbox";
      description = "Host path bind-mounted as Copyparty's inbox volume.";
    };

    mediaPath = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = "/srv/media";
      description = "Host path bind-mounted as Copyparty's media volume.";
    };
  };

  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = cfg.statePath != null;
        message = "guests.copyparty.statePath must point at the host directory that stores Copyparty state.";
      }
      {
        assertion = cfg.inboxPath != null;
        message = "guests.copyparty.inboxPath must point at the host directory served as /inbox.";
      }
      {
        assertion = cfg.mediaPath != null;
        message = "guests.copyparty.mediaPath must point at the host directory served as /media.";
      }
    ];

    guests.copyparty = {
      secrets = [ passwordSecret ];
      mounts = {
        ${stateDir}.hostPath = cfg.statePath;
        ${inboxDir}.hostPath = cfg.inboxPath;
        ${mediaDir}.hostPath = cfg.mediaPath;
      };
      limits = {
        memory = lib.mkDefault "2G";
        cpu = lib.mkDefault "200%";
        tasksMax = lib.mkDefault 512;
      };
    };

    sops.secrets.${passwordSecret} = {
      owner = toString serviceUid;
      group = "storage";
      mode = "0440";
    };

    systemd.tmpfiles.rules = [
      "d ${cfg.statePath} 0770 ${toString serviceUid} storage -"
    ];
  };
}