{
  config,
  lib,
  pkgs,
  ...
}:
let
  inherit (lib)
    mkIf
    flip
    ;

  cfg = config.services.headscale;
in
{
  services.headscale = {
    enable = true;
    address = "127.0.0.1";
    port = 8080;
    settings = {
      server_url = "https://headscale.sorre.xyz";
      database.sqlite = {
        path = "/var/lib/headscale/db.sqlite";
        write_ahead_log = true;
      };
      trusted_proxies = [
        "127.0.0.1/32"
        "::1/128"
      ];
      dns = {
        base_domain = "sorre.internal";
        override_local_dns = true;
        nameservers.global = [
          "1.1.1.1"
          "1.0.0.1"
        ];
        magic_dns = true;
        extra_records =
          let
            towerAddr = "100.0.0.6";
            towerSubdomains = [
              "music"
              "vaultwarden"
              "git"
              "kanboard"
            ];
          in
          flip map towerSubdomains (subdomain: {
            type = "A";
            name = "${subdomain}.${cfg.settings.dns.base_domain}";
            value = towerAddr;
          });
      };
      policy = {
        mode = "file";
        path = ./headscale-policy.json;
      };
    };
  };

  systemd.services.backup-headscale = mkIf cfg.enable {
    serviceConfig = {
      Type = "exec";
      User = cfg.user;
      Group = cfg.group;
      StateDirectory = "backups/headscale";
      StateDirectoryMode = "0700";
      Umask = "077";
    };
    description = "Back up headscale data";
    conflicts = [ "headscale.service" ];
    path = [ pkgs.gnutar ];
    enableStrictShellChecks = true;
    script = ''
      #!/usr/bin/env bash
      set -euo pipefail

      TIMESTAMP="$(date +%Y%m%d%H%M%S)"
      BACKUP_PATH="$STATE_DIRECTORY/$TIMESTAMP.backup.tar"
      echo "Backing up headscale to $BACKUP_PATH" >&2

      tar cf "$BACKUP_PATH" /var/lib/headscale
      chmod u=r,go-rwx "$BACKUP_PATH"

      find "$STATE_DIRECTORY" -type f -name '*.backup.tar' -print0 |
        sort --zero-terminated --reverse |
        tail --zero-terminated --lines=+6 |
        xargs --null --no-run-if-empty rm --
    '';
  };

  # See: https://unix.stackexchange.com/a/804263
  systemd.services.backup-headscale-restart-service = mkIf cfg.enable {
    unitConfig = {
      StopPropagatedFrom = "backup-headscale.service";
      Before = "backup-headscale.service";
      User = "root";
    };
    path = [ pkgs.systemdMinimal ];
    serviceConfig = {
      Type = "oneshot";
      User = "root";
      RemainAfterExit = true;
      ExecStop = "systemctl start headscale.service";
    };
    wantedBy = [ "backup-headscale.service" ];
  };

  systemd.timers.backup-headscale = mkIf cfg.enable {
    description = "Back up headscale every morning";
    timerConfig.OnCalendar = "*-*-* 05:00:00";
    wantedBy = [ "timers.target" ];
  };
}