{
  config,
  inputs,
  ...
}:
let
  domain = "opia.ovh";
  subdomain = "auth";
  port = 8083;
in
{
  imports = [
    inputs.tg-auth.nixosModules.tg-auth
  ];

  age.secrets.tgauth.file = ../../../secrets/tgauth.age;

  services.caddy = {
    extraConfig = ''
      (tg_auth) {
        forward_auth localhost:${toString port} {
            uri /
        }
      }
    '';
    virtualHosts."${subdomain}.${domain}" = {
      extraConfig = ''
        tls {
          dns_challenge_override_domain _acme-challenge.${subdomain}.opia.${config.networking.domain}
        }
        encode zstd gzip
        reverse_proxy localhost:${toString port}
      '';
    };
  };

  services.tg-auth = {
    enable = true;

    environment = {
      PORT = toString port;
      BOT_NAME = "OpiaCommunityBot"; # Username without @

      SIGNIN_URL = "https://${subdomain}.${domain}/signin";
      SIGNIN_REDIRECT_CALLBACK_URL = "https://${subdomain}.${domain}/signin/callback";
      SIGNIN_AFTER_SIGNIN_URL = "https://${subdomain}.${domain}/";

      AUTHZ_CHANNEL_IDS = "-1002285871016"; # may need "-100" in front, just "-" or neither
      AUTHZ_CACHE = "5m";

      AUTHN_COOKIE_NAME = "tgauth_session";
      AUTHN_COOKIE_DOMAIN = domain;
      AUTHN_SESSION_TTL = "48h";
    };

    environmentFile = config.age.secrets.tgauth.path;
  };
}