{
  config,
  lib,
  ...
}:
with lib; let
  psCfg = config.pub-solar;
  cfg = config.pub-solar.paperless;
in {
  systemd.services."container@paperless".unitConfig.RequiresMountsFor = [cfg.hostStateDir];

  containers."paperless" = mkIf cfg.enable {
    autoStart = true;
    ephemeral = true;

    tmpfs = ["/tmp:size=2G"];

    timeoutStartSec = "5min";

    bindMounts."/data" = {
      hostPath = cfg.hostStateDir;
      isReadOnly = false;
    };

    config = {
      config,
      pkgs,
      ...
    }: {
      networking.firewall.enable = false;

      # paperless
      services.paperless = {
        enable = true;
        dataDir = "/data";
        consumptionDir = "/data/ftp/consume";
        consumptionDirIsPublic = true;
        port = 8899;
        extraConfig = {
          PAPERLESS_FORCE_SCRIPT_NAME = "${cfg.path}";
          PAPERLESS_OCR_LANGUAGE = "deu+eng";
          PAPERLESS_ALLOWED_HOSTS = "${cfg.domain}";
          PAPERLESS_CSRF_TRUSTED_ORIGINS = "http://${cfg.domain}";
          PAPERLESS_CORS_ALLOWED_HOSTS = "http://${cfg.domain}";
          PAPERLESS_FILENAME_FORMAT = "{created_year}/{correspondent}/{created_month}_{created_day}_{title}";
          PAPERLESS_TASK_WORKERS=2;
          PAPERLESS_CONSUMER_INOTIFY_DELAY=5;
          PAPERLESS_CONSUMER_RECURSIVE=1;
          PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS=1;
        };
      };

      # increase timeout for systemd service
      systemd.services."paperless-scheduler".serviceConfig."TimeoutStartSec" = "300";

      # ftp
      users.users."paperless".extraGroups = mkIf cfg.ftp.enable ["ftp"];

      services.vsftpd = mkIf cfg.ftp.enable {
        enable = true;
        anonymousUser = true;
        anonymousUserNoPassword = true;
        anonymousUserHome = "/data/ftp";
        anonymousUploadEnable = true;
        anonymousUmask = "007";
        writeEnable = true;
        extraConfig = ''
          listen=YES
          listen_ipv6=NO
          listen_port=${toString cfg.ftp.listenPort}
          chown_uploads=YES
          chown_username=paperless
          download_enable=NO
          pasv_min_port=${toString cfg.ftp.pasvMinPort}
          pasv_max_port=${toString cfg.ftp.pasvMaxPort}
        '';
      };

      # nextcloud
      systemd.services.nextcloud-autosync = mkIf cfg.nextcloud.enable {
        unitConfig = {
          Description = "Auto sync Nextcloud";
          After = "network-online.target";
        };
        serviceConfig = {
          User = "paperless";
          Type = "simple";
          ExecStart = "${pkgs.nextcloud-client}/bin/nextcloudcmd -h -n --path Documents/_paperless /data/media/documents https://data.gssws.de";
          TimeoutStopSec = "180";
          KillMode = "process";
          KillSignal = "SIGINT";
        };
        wantedBy = ["multi-user.target"];
      };

      systemd.timers.nextcloud-autosync = mkIf cfg.nextcloud.enable {
        unitConfig.Description = "Automatic sync files with Nextcloud and rerun every 60 minutes";
        timerConfig.OnUnitActiveSec = "60min";
        wantedBy = ["multi-user.target" "timers.target"];
      };

      system.stateVersion = "23.05";
    };
  };
}