{
  lib,
  pkgs,
  config,
  ...
}:

let
  cfg = config.services.go-camo;
  inherit (lib)
    mkOption
    mkEnableOption
    mkIf
    types
    optionalString
    ;
in
{
  options.services.go-camo = {
    enable = mkEnableOption "go-camo service";
    listen = mkOption {
      type = types.nullOr types.str;
      default = null;
      description = "Address:Port to bind to for HTTP (default: 0.0.0.0:8080).";
      apply = v: optionalString (v != null) "--listen=${v}";
    };
    sslListen = mkOption {
      type = types.nullOr types.str;
      default = null;
      description = "Address:Port to bind to for HTTPS.";
      apply = v: optionalString (v != null) "--ssl-listen=${v}";
    };
    sslKey = mkOption {
      type = types.nullOr types.path;
      default = null;
      description = "Path to TLS private key.";
      apply = v: optionalString (v != null) "--ssl-key=${v}";
    };
    sslCert = mkOption {
      type = types.nullOr types.path;
      default = null;
      description = "Path to TLS certificate.";
      apply = v: optionalString (v != null) "--ssl-cert=${v}";
    };
    keyFile = mkOption {
      type = types.path;
      default = null;
      description = ''
        A file containing the HMAC key to use for signing URLs.
        The file can contain any string. Can be generated using "openssl rand -base64 18 > the_file".
      '';
    };
    extraOptions = mkOption {
      type = with types; listOf str;
      default = [ ];
      description = "Extra options passed to the go-camo command.";
    };
  };

  config = mkIf cfg.enable {
    systemd.services.go-camo = {
      description = "go-camo service";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      environment = {
        GOCAMO_HMAC_FILE = "%d/hmac";
      };
      script = ''
        GOCAMO_HMAC="$(cat "$GOCAMO_HMAC_FILE")"
        export GOCAMO_HMAC
        exec ${
          lib.escapeShellArgs (
            lib.lists.remove "" (
              [
                "${pkgs.go-camo}/bin/go-camo"
                cfg.listen
                cfg.sslListen
                cfg.sslKey
                cfg.sslCert
              ]
              ++ cfg.extraOptions
            )
          )
        }
      '';
      serviceConfig = {
        NoNewPrivileges = true;
        ProtectSystem = "strict";
        DynamicUser = true;
        User = "gocamo";
        Group = "gocamo";
        LoadCredential = [
          "hmac:${cfg.keyFile}"
        ];
      };
    };
  };
}
