{
  config,
  lib,
  pkgs,
  self,
  ...
}: let
  pubsolarDomain = import ./pubsolar-domain.nix;

  getSecret = name:
    lib.attrsets.setAttrByPath [name] {
      file = "${self}/secrets/${name}.age";
      mode = "600";
      owner = "concourse";
    };

  keys = [
    "concourse-session-signing-key"
    "concourse-worker-key"
    "concourse-tsa-host-key"
  ];

  secrets =
    [
      "concourse-secrets"
      "concourse-db-secrets"
    ]
    ++ keys;
in {
  age.secrets = lib.lists.foldl (a: b: a // getSecret b) {} secrets;

  users.users.concourse = {
    description = "Concourse Service";
    home = "/var/lib/concourse";
    useDefaultShell = true;
    group = "concourse";
    isSystemUser = true;
  };

  users.groups.concourse = {};
  users.groups.postgres = {};
  ids.uids.concourse = 995;
  ids.gids.concourse = 995;

  systemd.tmpfiles.rules = [
    "d '/data/concourse/db' 0770 ${builtins.toString config.ids.uids.postgres} postgres - -"
  ];

  system.activationScripts.mkConcourseNet = let
    docker = config.virtualisation.oci-containers.backend;
    dockerBin = "${pkgs.${docker}}/bin/${docker}";
  in ''
    ${dockerBin} network inspect concourse-net >/dev/null 2>&1 || ${dockerBin} network create concourse-net --subnet 172.20.0.0/24
  '';

  virtualisation.oci-containers = {
    containers."concourse-db" = {
      image = "postgres:14";
      autoStart = true;
      user = builtins.toString config.ids.uids.postgres;
      volumes = [
        "/data/concourse/db:/var/lib/postgresql/data"
      ];
      extraOptions = [
        "--network=concourse-net"
      ];
      environmentFiles = [
        config.age.secrets.concourse-db-secrets.path
      ];
    };

    containers."concourse" = {
      image = "concourse/concourse:7.9.1";
      autoStart = true;
      user = builtins.toString config.ids.uids.concourse;
      ports = [
        "8080:8080"
      ];
      dependsOn = ["concourse-db"];
      extraOptions = [
        "--network=concourse-net"
      ];
      volumes = [
        "${config.age.secrets.concourse-session-signing-key.path}:/keys/session_signing_key"
        "${config.age.secrets.concourse-worker-key.path}:/keys/worker_key"
        "${config.age.secrets.concourse-tsa-host-key.path}:/keys/tsa_host_key"
      ];

      environment = {
        CONCOURSE_EXTERNAL_URL = "https://ci.${pubsolarDomain}";

        CONCOURSE_ADD_LOCAL_USER = "crew:changeme";
        CONCOURSE_MAIN_TEAM_LOCAL_USER = "crew";

        # instead of relying on the default "detect"
        CONCOURSE_WORKER_BAGGAGECLAIM_DRIVER = "overlay";
        CONCOURSE_X_FRAME_OPTIONS = "allow";
        CONCOURSE_CONTENT_SECURITY_POLICY = "*";
        CONCOURSE_CLUSTER_NAME = "pub.solar";
        CONCOURSE_WORKER_CONTAINERD_DNS_SERVER = "8.8.8.8";

        CONCOURSE_SESSION_SIGNING_KEY = "/keys/session_signing_key";
        CONCOURSE_TSA_HOST_KEY = "/keys/tsa_host_key";
        CONCOURSE_TSA_AUTHORIZED_KEYS = "/keys/worker_key";

        # For ARM-based machine, change the Concourse runtime to "houdini"
        CONCOURSE_WORKER_RUNTIME = "containerd";
      };
      environmentFiles = [
        config.age.secrets.concourse-secrets.path
      ];
    };
  };
}