{
  flake,
  lib,
  config,
  pkgs,
  ...
}:
with lib; let
  psCfg = config.pub-solar;
  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in {
  age.secrets."authelia-storage-encryption-key" = {
    file = "${flake.self}/secrets/authelia-storage-encryption-key.age";
    mode = "400";
    owner = "authelia-b12f";
  };

  age.secrets."authelia-session-secret" = {
    file = "${flake.self}/secrets/authelia-session-secret.age";
    mode = "400";
    owner = "authelia-b12f";
  };

  age.secrets."authelia-jwt-secret" = {
    file = "${flake.self}/secrets/authelia-jwt-secret.age";
    mode = "400";
    owner = "authelia-b12f";
  };

  age.secrets."authelia-users-file" = {
    file = "${flake.self}/secrets/authelia-users-file.age";
    mode = "400";
    owner = "authelia-b12f";
  };

  age.secrets."mail@b12f.io-password" = {
    file = "${flake.self}/secrets/mail@b12f.io-password.age";
    mode = "400";
    owner = "authelia-b12f";
  };

  security.acme.certs = {
    "auth.b12f.io" = {};
  };

  services.nginx.virtualHosts = {
    "auth.b12f.io" = {
      forceSSL = true;
      useACMEHost = "auth.b12f.io";
      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.authelia.instances.b12f.settings.server.port}";
      locations."/".extraConfig = "include /etc/nginx/conf-available/proxy.conf;";
      locations."/api/verify".proxyPass = "http://127.0.0.1:${builtins.toString config.services.authelia.instances.b12f.settings.server.port}";
      locations."/api/authz".proxyPass = "http://127.0.0.1:${builtins.toString config.services.authelia.instances.b12f.settings.server.port}";
    };
  };

  services.authelia.instances.b12f = {
    enable = true;

    secrets = {
      storageEncryptionKeyFile = config.age.secrets."authelia-storage-encryption-key".path;
      sessionSecretFile = config.age.secrets."authelia-session-secret".path;
      jwtSecretFile = config.age.secrets."authelia-jwt-secret".path;
    };

    settings = {
      theme = "light";
      default_2fa_method = "webauthn";
      log.level = "debug";
      server = {
        port = 9092;
        host = "127.0.0.1";
      };
      authentication_backend = {
        refresh_interval = "disable";
        password_reset = { disable = true; };
        file = {
          path = config.age.secrets."authelia-users-file".path;
          watch = false;
        };
      };
      duo_api.disable = true;
      webauthn.user_verification = "required";
      totp.issuer = "auth.b12f.io";
      storage.local.path = "/var/lib/authelia-b12f/db.sqlite3";
      access_control.default_policy = "two_factor";
      session = {
        domain = "auth.b12f.io";
        # authelia_url = "https://auth.b12f.io";
      };
      notifier.disable_startup_check = true;
      notifier.smtp = {
        host = "mail.b12f.io";
        port = 587;
        username = "mail@b12f.io";
        sender = "auth.b12f.io <mail@b12f.io>";
        identifier = "auth@b12f.io";
        subject = "[auth.b12f.io] {title}";
      };
    };
  };

  systemd.services.authelia-b12f.environment.AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE = config.age.secrets."mail@b12f.io-password".path;

  services.restic.backups = {
    authelia = {
      paths = [ "/var/lib/authelia-b12f" ];
      initialize = true;
      passwordFile = config.age.secrets."restic-password".path;
      # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
      repository = "rclone:cloud.pub.solar:/backups/Authelia";
      rcloneConfigFile = config.age.secrets."rclone-pie.conf".path;
    };
  };
}