{
  machineConfig,
  config,
  lib,
  utils,
  pkgs,
  ...
}:

{

  options.zpha.websites."assets.noncd.de".enable = lib.mkEnableOption "";

  config = lib.mkIf config.zpha.websites."assets.noncd.de".enable (
    let
      filebrowserSettings = {
        server = {
          listen = "[::1]";
          port = 1312;

          database = "/var/lib/datendrehscheibe/database.sqlite";
          cacheDir = "/var/cache/datendrehscheibe";

          disableUpdateCheck = true;
          externalUrl = "https://assets.noncd.de";

          sources = [
            {
              path = "${config.users.users.datendrehscheibe.home}";
              config.defaultEnabled = false;
            }
            {
              path = "${config.users.users.datendrehscheibe.home}/etc";
              config.defaultEnabled = true;
            }
            {
              path = "${config.users.users.datendrehscheibe.home}/Sounds";
              config.defaultEnabled = true;
            }
            {
              path = "${config.users.users.datendrehscheibe.home}/Bahnvorschriften";
              config.defaultEnabled = true;
            }
            {
              path = "${config.users.users.datendrehscheibe.home}/Designvorgaben";
              config.defaultEnabled = true;
            }
            {
              path = "${config.users.users.datendrehscheibe.home}/Regelzeichnungen";
              config.defaultEnabled = true;
            }
            {
              path = "${config.users.users.datendrehscheibe.home}/Serviceeinrichtungen";
              config.defaultEnabled = true;
            }
            {
              path = "${config.users.users.datendrehscheibe.home}/Kursbücher";
              config.defaultEnabled = true;
            }
            {
              path = "${config.users.users.datendrehscheibe.home}/Technische Unterlagen";
              config.defaultEnabled = true;
            }
            {
              path = "${config.users.users.datendrehscheibe.home}/Fonts";
              config.defaultEnabled = true;
            }
            {
              path = "${config.users.users.datendrehscheibe.home}/Source-Code";
              config.defaultEnabled = true;
            }
          ];
        };

        frontend = {
          name = "assets.noncd.de";
          # disableNavButtons = true;
          disableDefaultLinks = true;
        };

        auth = {
          adminUsername = "zaphyra";
          methods.password = {
            enabled = true;
            minLength = 8;
          };
        };

        userDefaults = {
          stickySidebar = true;
          singleClick = true;
          viewMode = "list";
        };
      };

    in
    {
      dns.zones."assets.noncd.de".AAAA = [ machineConfig.networking.ip6Address ];

      sops.secrets = {
        "restic/datendrehscheibe/repositoryPassword" = { };
        "restic/datendrehscheibe/sshPrivateKey" = { };
      };

      common = {
        configure.persist.system.dirs = lib.singleton {
          directory = "/var/lib/datendrehscheibe";
          mode = "700";
          user = config.systemd.services.datendrehscheibe-filebrowser.serviceConfig.User;
          group = config.systemd.services.datendrehscheibe-filebrowser.serviceConfig.Group;
        };
        services.resticBackup.datendrehscheibe = {
          enable = true;
          targets = [
            "restic-target.fc9f.de"
          ];
          sshKeyFile = config.sops.secrets."restic/datendrehscheibe/sshPrivateKey".path;
          passwordFile = config.sops.secrets."restic/datendrehscheibe/repositoryPassword".path;
          user = config.systemd.services.datendrehscheibe-filebrowser.serviceConfig.User;
          paths = [ "/mnt/datendrehscheibe" ];
        };

      };

      fileSystems."/mnt/datendrehscheibe" = {
        device = "/dev/mapper/data";
        fsType = "btrfs";
        options = [
          "subvol=datendrehscheibe"
          "compress=zstd"
          "discard=async"
        ];
      };

      users = {
        groups.datendrehscheibe.gid = 1312;
        users.datendrehscheibe = {
          isNormalUser = true;
          uid = 1312;
          home = "/mnt/datendrehscheibe";
          group = "datendrehscheibe";
          extraGroups = [ "ssh" ];
        };
      };

      systemd.services.datendrehscheibe-filebrowser = {
        after = [ "network.target" ];
        description = "FileBrowser";
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          User = "datendrehscheibe";
          Group = "datendrehscheibe";
          UMask = "0077";

          StateDirectory = "datendrehscheibe";
          CacheDirectory = "datendrehscheibe";
          WorkingDirectory = config.users.users.datendrehscheibe.home;

          ExecStart =
            let
              args = [
                (lib.getExe pkgs.filebrowser-quantum)
                "-c"
                ((pkgs.formats.yaml { }).generate "filebrowser-config.yaml" filebrowserSettings)
              ];
            in
            utils.escapeSystemdExecArgs args;

          NoNewPrivileges = true;
          PrivateDevices = true;
          ProtectKernelTunables = true;
          ProtectKernelModules = true;
          ProtectControlGroups = true;
          MemoryDenyWriteExecute = true;
          LockPersonality = true;
          DevicePolicy = "closed";
          RestrictNamespaces = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          RestrictAddressFamilies = [
            "AF_UNIX"
            "AF_INET"
            "AF_INET6"
          ];
        };
      };

      services.nginx.virtualHosts."assets.noncd.de" = {
        useACMEHost = config.networking.fqdn;
        forceSSL = true;
        kTLS = true;
        locations."/" = {
          proxyPass = "http://${toString filebrowserSettings.server.listen}:${toString filebrowserSettings.server.port}";
          proxyWebsockets = true;
          extraConfig = ''
            client_max_body_size 50M;
          '';
        };
      };
    }
  );

}