{
  flake,
  config,
  lib,
  pkgs,
  ...
}: {
  age.secrets.keycloak-database-password = {
    file = "${flake.self}/secrets/keycloak-database-password.age";
    mode = "700";
    #owner = "keycloak";
  };

  services.nginx.virtualHosts."auth.pub.solar" = {
    enableACME = true;
    forceSSL = true;

    locations = {
      "= /" = {
        extraConfig = ''
          return 302 /realms/pub.solar/account;
        '';
      };

      "/" = {
        extraConfig = ''
          proxy_pass http://127.0.0.1:8080;
          proxy_buffer_size 8k;
        '';
      };
    };
  };

  # keycloak
  services.keycloak = {
    enable = true;
    database.passwordFile = config.age.secrets.keycloak-database-password.path;
    settings = {
      hostname = "auth.pub.solar";
      http-host = "127.0.0.1";
      http-port = 8080;
      proxy = "edge";
      features = "declarative-user-profile";
    };
    themes = {
      "pub.solar" = flake.inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar;
    };
  };

  services.restic.backups.keycloak = {
    paths = [
      "/tmp/keycloak-backup.sql"
    ];
    timerConfig = {
      OnCalendar = "*-*-* 02:00:00 Etc/UTC";
      # droppie will be offline if nachtigall misses the timer
      Persistent = false;
    };
    initialize = true;
    passwordFile = config.age.secrets."restic-repo-droppie".path;
    repository = "yule@droppie.b12f.io:/media/internal/backups-pub-solar";
    backupPrepareCommand = ''
      ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d keycloak > /tmp/keycloak-backup.sql
    '';
    backupCleanupCommand = ''
      rm /tmp/keycloak-backup.sql
    '';
  };
}