{
  config,
  lib,
  pkgs,
  ...
}:
let
  domain = "opia.ovh";
  subdomain = "archive";

  pkg = pkgs.tg-archive;
  format = pkgs.formats.yaml { };

  groups = {
    main = "Opia Community Group Chat";
  };

  # see https://github.com/knadh/tg-archive/blob/master/tgarchive/example/config.yaml
  genCfg = name: group: {
    inherit group;

    download_media = true;
    download_avatars = true;
    avatar_size = [
      64
      64
    ];
    media_dir = "media";

    media_mime_types = [ ];

    proxy = {
      enable = false;
    };

    fetch_batch_size = 2000;
    fetch_wait = 5;
    fetch_limit = 0;

    publish_dir = "${config.users.users.tg-archive.home}/sites/${name}";
    static_dir = "static";
    per_page = 500;
    show_day_index = true;

    telegram_url = "https://t.me/{id}";
    show_sender_fullname = false;
    timezone = ""; # https://github.com/knadh/tg-archive/issues/130

    publish_rss_feed = false;
    rss_feed_entries = 100;

    site_url = "https://${subdomain}.${domain}";
    site_name = "@{group} - Telegram group archive";
    site_description = "Public archive of Telegram messages.";
    meta_description = "@{group} {date} - Telegram message archive.";
    page_title = "Page {page} - {date} @{group} Telegram message archive.";
  };

  genScript =
    name: group:
    let
      cfgFile = format.generate "tg-archive.yaml" (genCfg name group);
      dir = "data/${name}";
    in
    ''
      if test ! -d "${dir}"
      then
          ${lib.getExe pkg} --config ${cfgFile} --new --path ${dir}
      fi
      cd "${dir}"

      export API_ID API_HASH

      ${lib.getExe pkg} --config ${cfgFile} --sync

      ${lib.getExe pkg} --config ${cfgFile} --build
    '';
in
{
  age.secrets.tg-archive.file = ../../../secrets/tg-archive.age;

  users.groups.tg-archive = {
    members = [ "caddy" ];
  };
  users.users.tg-archive = {
    home = "/var/lib/tg-archive";
    homeMode = "750";
    createHome = true;
    isSystemUser = true;
    group = "tg-archive";
  };

  environment.systemPackages = [ pkgs.tg-archive ];

  systemd.services.tg-archive = {
    description = "Telegram Archive";
    serviceConfig = {
      Type = "oneshot";
      WorkingDirectory = config.users.users.tg-archive.home;
      EnvironmentFile = [ config.age.secrets.tg-archive.path ];
      User = "tg-archive";
      Group = "tg-archive";
    };

    preStart = ''
      if test ! -d data
      then
        mkdir data
      fi
      if test ! -d sites
      then
        mkdir sites
      fi
    '';
    script = lib.concatMapAttrsStringSep "\n" genScript groups;
  };

  services.caddy.virtualHosts = {
    "${subdomain}.${domain}" = {
      extraConfig = ''
        import tg_auth
        tls {
          dns_challenge_override_domain _acme-challenge.${subdomain}.opia.${config.networking.domain}
        }
        encode
        root ${config.users.users.tg-archive.home}/sites/
        file_server browse
      '';
    };
  };
}