{
  config,
  pkgs,
  ...
}:
let
  domain = config.networking.domain;
  ts-domain = "fin-marlin.ts.net";
in
{
  age.secrets.readeck.file = ../../secrets/readeck.age;

  services.readeck = {
    enable = true;
    package = pkgs.readeck.overrideAttrs (attrs: rec {
      version = "0.22.0-pre1";
      src = pkgs.fetchFromCodeberg {
        owner = "readeck";
        repo = "readeck";
        rev = "12e39b6fe20d3949b249b1410b83ea8ea5043046";
        hash = "sha256-QOnxTUlC+TaU/MSDSIg8T3cc7dScojVGVyM7kltljbA=";
      };

      vendorHash = "sha256-2MB7v5oG/LcEKtgbFNxPXSI8TljpbqYUrI7pvu7m+e8=";

      npmDeps = pkgs.fetchNpmDeps {
        src = "${src}/web";
        hash = "sha256-znUKRaUdx6GXD2YL6hs0iveaAAHQ8H9n4NHZFi331+g=";
      };
    });
    environmentFile = config.age.secrets.readeck.path;
    settings = {
      server = {
        host = "unix:/run/web/readeck.sock?mode=0660";
        base_url = "https://read.${ts-domain}";
      };
      email = {
        host = "localhost";
        port = 587;
        from = "readeck@${domain}";
        from_noreply = "noreply+readeck@${domain}";
      };
      auth.forwarded = {
        enabled = true;
        provisioning = false;
        header_user = "X-Webauth-User";
        header_email = "X-Webauth-Email";
      };
    };
  };

  services.caddy.virtualHosts = {
    "read.${ts-domain}" = {
      extraConfig = ''
        bind tailscale/read
        tailscale_auth
        reverse_proxy {
          to unix//run/web/readeck.sock
          header_up X-Webauth-User {http.auth.user.tailscale_login}
          header_up X-Webauth-Email {http.auth.user.tailscale_user}
        }
      '';
    };
  };

  systemd.services.readeck.serviceConfig = {
    SupplementaryGroups = [ "webservice" ];
  };
}