{
  config,
  ...
}:
let
  subdomain = "hs.alin.ovh";
  issuer = "https://id.alin.ovh";
  inherit (config.services) headscale headplane;
in
{
  age.secrets = {
    headscale-oidc = {
      file = ../../secrets/headscale-oidc.age;
      owner = headscale.user;
      group = headscale.group;
    };
    headplane-cookie = {
      file = ../../secrets/headplane-cookie.age;
      owner = headscale.user;
      group = headscale.group;
    };
    headplane-headscale-api = {
      file = ../../secrets/headplane-headscale-api.age;
      owner = headscale.user;
      group = headscale.group;
    };
    headplane-oidc = {
      file = ../../secrets/headplane-oidc.age;
      owner = headscale.user;
      group = headscale.group;
    };
  };

  services.headscale = {
    enable = true;
    port = 18443;
    settings = {
      # acme_url = config.security.acme.defaults.server;
      # tls_letsencrypt_hostname = domain;
      # tls_letsencrypt_listen = ":18080";
      server_url = "https://${subdomain}";
      tls_cert_path = null;
      tls_key_path = null;
      trusted_proxies = [
        "127.0.0.1/32"
        "::1/128"
      ];
      oidc = {
        issuer = issuer;
        client_id = "e1658483-71ee-4260-9862-a92b9fdadece";
        client_secret_path = config.age.secrets.headscale-oidc.path;
        pkce = {
          enabled = true;
          method = "S256";
        };
      };
      prefixes.allocation = "random";
      node.expiry = "180d";
      dns = {
        magic_dns = false;
        override_local_dns = false;
      };
    };
  };

  services.headplane = {
    enable = true;
    settings = {
      headscale = {
        url = headscale.settings.server_url;
      };
      server = {
        base_url = headscale.settings.server_url;
        cookie_secret_path = config.age.secrets.headplane-cookie.path;
      };
      oidc = {
        headscale_api_key_path = config.age.secrets.headplane-headscale-api.path;
        client_id = "d7e09578-158a-4954-ba86-d3e9177c1a15";
        client_secret_path = config.age.secrets.headplane-oidc.path;
        issuer = issuer;
      };
    };
  };

  services.caddy.virtualHosts = {
    ${subdomain} = {
      extraConfig = ''
        reverse_proxy /admin/* localhost:${toString headplane.settings.server.port}

        reverse_proxy localhost:${toString headscale.port}
      '';
    };
  };
}