{
  flake,
  config,
  ...
}:
let
  inherit (flake.config.people) user0;
  inherit (flake.config.services) instances;
  serviceCfg = instances.firefly-iii;
  smtpCfg = instances.smtp;
in
{
  fireflyVM =
    {
      user,
      ip,
      mac,
      userMac,
      ssh,
      host,
      owner,
      mnt,
    }:
    {
      microvm.vms = {
        "${serviceCfg.name}-${user}" = {
          autostart = true;
          restartIfChanged = true;
          config = {
            system.stateVersion = "24.05";
            time.timeZone = "America/Winnipeg";
            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
            services = {
              firefly-iii = {
                enable = true;
                enableNginx = false;
                poolConfig = {
                  "listen.owner" = config.services.caddy.user;
                  "pm" = "dynamic";
                  "pm.max_children" = 32;
                  "pm.start_servers" = 2;
                  "pm.min_spare_servers" = 2;
                  "pm.max_spare_servers" = 4;
                  "pm.max_requests" = 500;
                };
                settings = {
                  APP_URL = "https://${host}";
                  APP_KEY_FILE = "/etc/firefly-secrets/${user}-pass";
                  DB_PASSWORD_FILE = "/etc/firefly-secrets/${user}-data";
                  DB_CONNECTION = "pgsql";
                  DB_HOST = "/run/postgresql";
                  DB_DATABASE = serviceCfg.name;
                  DB_USERNAME = serviceCfg.name;
                  MAIL_MAILER = smtpCfg.name;
                  MAIL_HOST = smtpCfg.interfaces.interface0.domain;
                  MAIL_PORT = smtpCfg.ports.port0;
                  MAIL_FROM = smtpCfg.interfaces.interface0.email;
                  MAIL_USERNAME = smtpCfg.interfaces.interface0.email;
                  MAIL_PASSWORD_FILE = "/etc/firefly-secrets/${user}-smtp";
                  MAIL_ENCRYPTION = "tls";
                  SITE_OWNER = owner;
                };
              };
              phpfpm.pools.firefly-iii.phpEnv = {
                TRUSTED_PROXIES = "*";
                APP_URL = "https://${host}";
              };
              firefly-iii-data-importer = {
                enable = true;
              };
              caddy = {
                enable = true;
                virtualHosts.":80" = {
                  extraConfig = ''
                    root * ${config.services.firefly-iii.package}/public
                    file_server
                    encode gzip
                    php_fastcgi unix//run/phpfpm/firefly-iii.sock {
                      env HTTPS {http.request.header.X-Forwarded-Proto}
                      env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto}
                    }
                  '';
                };
              };
              postgresql = {
                enable = true;
                ensureDatabases = [ "firefly-iii" ];
                ensureUsers = [
                  {
                    name = "firefly-iii";
                    ensureDBOwnership = true;
                  }
                ];
              };

              openssh = {
                enable = true;
                settings = {
                  PasswordAuthentication = false;
                  PermitRootLogin = "prohibit-password";
                };
              };
            };
            networking.firewall.allowedTCPPorts = [
              22
              80
              smtpCfg.ports.port1
              serviceCfg.ports.port0
              serviceCfg.ports.port1
            ];
            systemd = {
              services = {
                caddy = {
                  after = [ "phpfpm-firefly-iii.service" ];
                  requires = [ "phpfpm-firefly-iii.service" ];
                };
                fix-secrets-permissions = {
                  description = "Fix secrets permissions for firefly-iii";
                  wantedBy = [ "multi-user.target" ];
                  before = [
                    "firefly-iii-setup.service"
                    "phpfpm-firefly-iii.service"
                  ];
                  serviceConfig = {
                    Type = "oneshot";
                    RemainAfterExit = true;
                  };
                  script = ''
                    mkdir -p /etc/firefly-secrets
                    cp /run/secrets/${user}-pass /etc/firefly-secrets/${user}-pass
                    cp /run/secrets/${user}-data /etc/firefly-secrets/${user}-data
                    cp /run/secrets/${user}-smtp /etc/firefly-secrets/${user}-smtp
                    chmod 755 /etc/firefly-secrets
                    chmod 644 /etc/firefly-secrets/*
                  '';
                };
                systemd-networkd.wantedBy = [ "multi-user.target" ];
              };
              network = {
                enable = true;
                networks."20-lan" = {
                  matchConfig.Name = "enp0s6";
                  addresses = [
                    { Address = "${ip}/24"; }
                  ];
                  routes = [
                    {
                      Destination = "0.0.0.0/0";
                      Gateway = "192.168.50.1";
                    }
                  ];
                  dns = [
                    "1.1.1.1"
                    "8.8.8.8"
                  ];
                };
              };
              tmpfiles.rules = [
                "d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
              ];
            };
            microvm = {
              vcpu = 1;
              mem = 512;
              hypervisor = "qemu";
              interfaces = [
                {
                  type = "tap";
                  id = "vm-ff-${user}";
                  mac = mac;
                }
                {
                  type = "user";
                  id = "vmuser-firefly";
                  mac = userMac;
                }
              ];
              forwardPorts = [
                {
                  from = "host";
                  host.port = ssh;
                  guest.port = 22;
                }
              ];
              shares = [
                {
                  mountPoint = "/nix/.ro-store";
                  proto = "virtiofs";
                  source = "/nix/store";
                  tag = "read_only_nix_store";
                }
                {
                  mountPoint = "/var/lib/${serviceCfg.name}";
                  proto = "virtiofs";
                  source = "${mnt}/${serviceCfg.name}/config";
                  tag = "${serviceCfg.name}_${user}_config";
                }
                {
                  mountPoint = "/var/lib/postgresql";
                  proto = "virtiofs";
                  source = "${mnt}/${serviceCfg.name}/data";
                  tag = "${serviceCfg.name}_${user}_data";
                }
                {
                  mountPoint = "/run/secrets";
                  proto = "virtiofs";
                  source = "/run/secrets/${serviceCfg.name}";
                  tag = "host_secrets";
                }
              ];
            };
          };
        };
      };

      systemd.tmpfiles.rules = [
        "d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
        "d ${mnt}/${serviceCfg.name}/config 0751 microvm wheel - -"
        "d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
      ];

      sops = {
        secrets = builtins.listToAttrs (
          map
            (secret: {
              name = "${serviceCfg.name}/${user}-${secret}";
              value = {
                owner = "root";
                group = "root";
                mode = "0644";
              };
            })
            [
              "pass"
              "data"
              "smtp"
            ]
        );
      };
    };
}