{
  config,
  lib,
  pkgs,
  ...
}:

let
  inherit (lib) types;

  cfg = config.services.goaccess;

  # Helper function to generate a configuration file from the settings module
  settingsFormat = pkgs.formats.keyValue {
    mkKeyValue = pkgs.lib.generators.mkKeyValueDefault { } " ";
    listsAsDuplicateKeys = true;
  };

  instanceName = name: "goaccess@${name}";

  enabledInstances = lib.filterAttrs (name: conf: conf.enable) config.services.goaccess.instances;
in
{
  options.services.goaccess = {
    package = lib.mkPackageOption pkgs "goaccess" { };

    user = lib.mkOption {
      type = types.str;
      default = "goaccess";
      description = "User to run goaccess service as";
    };

    group = lib.mkOption {
      type = types.str;
      default = "goaccess";
      description = "Group to run goaccess service as";
    };

    instances = lib.mkOption {
      type =
        with types;
        attrsOf (
          submodule (
            { config, name, ... }:
            {
              options = {
                enable = lib.mkEnableOption "goaccess web log analyzer service";

                # Timer configuration for non-real-time mode
                dates = lib.mkOption {
                  type = with types; nullOr str;
                  default = null;
                  example = "daily";
                  description = ''
                    Systemd timer specification for periodic report generation.
                    Only applies when real-time HTML is disabled.
                    Examples: "daily", "hourly", "*-*-* 06:00:00" (at 6 AM every day)
                  '';
                };

                # RFC42-compatible settings module
                settings = lib.mkOption {
                  type = types.submodule {
                    freeformType = settingsFormat.type;
                    options = {
                      # Basic configuration
                      log-file = lib.mkOption {
                        type = with types; either path (listOf path);
                        default = "/var/log/nginx/access.log";
                        description = "Path to the web server access log file to analyze";
                      };

                      output = lib.mkOption {
                        type = types.path;
                        default = "/var/www/html/goaccess/report.html";
                        description = "Path for the output HTML report";
                      };

                      # Mode selection
                      real-time-html = lib.mkOption {
                        type = types.bool;
                        default = false;
                        description = "Enable real-time HTML output with WebSocket support";
                      };

                      # Log format configuration
                      log-format = lib.mkOption {
                        type = types.str;
                        default = "COMBINED";
                        description = ''
                          Log format specification. Can be a predefined format name
                          (COMBINED, COMMON, VCOMBINED, etc.) or a custom format string.
                        '';
                      };

                      ignore-crawlers = lib.mkOption {
                        type = types.bool;
                        default = false;
                        description = "Ignore crawlers/bots from statistics";
                      };

                      anonymize-ip = lib.mkOption {
                        type = types.bool;
                        default = false;
                        description = "Anonymize client IP addresses for privacy";
                      };

                      anonymize-level = lib.mkOption {
                        type = types.enum [
                          1
                          2
                          3
                        ];
                        default = 1;
                        description = "IP anonymization level (1=default, 2=strong, 3=pedantic)";
                      };

                      # Persistence options
                      persist = lib.mkOption {
                        type = types.bool;
                        default = false;
                        description = "Persist parsed data to disk for incremental processing";
                      };

                      restore = lib.mkOption {
                        type = types.bool;
                        default = false;
                        description = "Load previously stored data from disk";
                      };

                      db-path = lib.mkOption {
                        type = types.path;
                        default = "/var/lib/goaccess/${name}";
                        description = "Path for on-disk database files";
                      };

                      keep-last = lib.mkOption {
                        type = with types; nullOr int;
                        default = null;
                        description = "Keep only the last N days in storage (enables data recycling)";
                      };

                      # Process configuration
                      jobs = lib.mkOption {
                        type = types.int;
                        default = 1;
                        description = "Number of parallel processing threads (1-6)";
                      };

                      chunk-size = lib.mkOption {
                        type = types.int;
                        default = 4096;
                        description = "Number of lines per chunk for parallel processing (256-32768)";
                      };

                      # Server configuration for real-time mode
                      unix-socket = lib.mkOption {
                        type = with types; nullOr str;
                        default = null;
                        example = "/run/goaccess.sock";
                      };

                      port = lib.mkOption {
                        type = types.port;
                        default = 7890;
                        description = "Port for the WebSocket server (real-time mode only)";
                      };

                      addr = lib.mkOption {
                        type = with types; nullOr str;
                        default = "0.0.0.0";
                        description = "IP address to bind the WebSocket server to";
                      };

                      # WebSocket URL for real-time mode
                      ws-url = lib.mkOption {
                        type = with types; nullOr str;
                        default = null;
                        description = ''
                          URL for WebSocket connection (useful when running behind proxy).
                          If not set, defaults to the generated report's hostname.
                        '';
                      };
                    };
                  };
                  default = { };
                  description = ''
                    RFC42-compatible settings for goaccess configuration file.
                    These options will be written to a configuration file and passed to GoAccess via --config-file.
                    See https://goaccess.io/man for all available options.
                  '';
                  example = {
                    log-file = "/var/log/nginx/access.log";
                    output = "/var/www/html/goaccess/report.html";
                    log-format = "COMBINED";
                    html-report-title = "My Server Analytics";
                    ignore-crawlers = true;
                    anonymize-ip = true;
                  };
                };
              };
            }
          )
        );
      default = { };
      description = "GoAccess web log analyzer service instances";
      example = {
        web-logs = {
          enable = true;
          settings = {
            log-file = "/var/log/nginx/access.log";
            output = "/var/www/html/goaccess/web-logs.html";
            real-time-html = true;
            port = 7890;
          };
        };
        api-logs = {
          enable = true;
          dates = "daily";
          settings = {
            log-file = "/var/log/nginx/api-access.log";
            output = "/var/www/html/goaccess/api-logs.html";
            html-report-title = "API Analytics";
          };
        };
      };
    };
  };

  config = lib.mkIf (enabledInstances != { }) (
    lib.mkMerge [
      {
        environment.systemPackages = [ cfg.package ];

        # Create user and group if needed
        users.users.goaccess = lib.mkIf (cfg.user == "goaccess") {
          isSystemUser = true;
          group = cfg.group;
          home = "/var/lib/goaccess";
          createHome = true;
        };

        users.groups.goaccess = lib.mkIf (cfg.group == "goaccess") { };
      }

      # Generate systemd services for all enabled instances
      {
        systemd.services = lib.mapAttrs' (
          name: instanceCfg:
          let
            configFile = settingsFormat.generate name instanceCfg.settings;
            realTime = instanceCfg.settings.real-time-html or false;
          in
          lib.nameValuePair (instanceName name) {
            description = "GoAccess Web Log Analyzer (${name})";
            wantedBy = if realTime then [ "multi-user.target" ] else [ "timers.target" ];

            serviceConfig = {
              Type = if realTime then "simple" else "oneshot";
              ExecStart = "${cfg.package}/bin/goaccess --no-parsing-spinner --config-file=${configFile}";
              ExecStartPre =
                "+"
                + pkgs.writeShellScript "goaccess-${name}-prep" ''
                  install -d -o ${cfg.user} -g ${cfg.group} -m 0750 ${dirOf instanceCfg.settings.output}
                '';
              User = cfg.user;
              Group = cfg.group;
              Restart = lib.mkIf realTime "on-failure";
              # Ensure directories exist and have correct permissions
              StateDirectory = "goaccess/${name}";
              RuntimeDirectory = "goaccess";
              RuntimeDirectoryMode = "750";
              # Security settings
              NoNewPrivileges = true;
              PrivateTmp = true;
              ProtectSystem = "strict";
              ProtectHome = true;
              ReadOnlyPaths = (lib.flatten instanceCfg.settings.log-file);
              ReadWritePaths = [
                ("-" + dirOf instanceCfg.settings.output)
              ];
            };
          }
        ) enabledInstances;

        systemd.timers = lib.mapAttrs' (
          name: instanceCfg:
          (lib.nameValuePair (instanceName name) {
            description = "Timer for GoAccess report generation (${name})";
            wantedBy = [ "timers.target" ];
            timerConfig = {
              OnCalendar = instanceCfg.dates;
              Persistent = true;
            };
          })
        ) (lib.filterAttrs (_: icfg: icfg.dates != null) enabledInstances);

        systemd.tmpfiles.rules = lib.flatten (
          lib.mapAttrsToList (name: icfg: [
            "d ${icfg.settings.db-path} 1700 ${cfg.user} ${cfg.group} -"
          ]) (lib.filterAttrs (_: icfg: icfg.settings.persist || icfg.settings.restore) enabledInstances)
        );
      }

      # Generate assertions for all enabled instances
      {
        assertions = lib.mapAttrsToList (name: instanceCfg: {
          assertion = (instanceCfg.settings.real-time-html or false) != (instanceCfg.dates != null);
          message = ''
            services.goaccess.instances.${name}: Exactly one of real-time-html or dates must be specified.
            - Set real-time-html to true for real-time HTML output with WebSocket support.
            - Set dates to a timer specification for periodic static report generation.
          '';
        }) enabledInstances;
      }
    ]
  );
}