{
  config,
  flake,
  ...
}: let
  inherit (flake.config.system.device) server;
  inherit (flake.config.service.instance.minecraft) paths ports name sops;
in {
  services = {
    minecraft-server = {
      enable = true;
      eula = true;
      openFirewall = true;
      declarative = true;
      serverProperties = {
        "rcon.password" = config.sops.secrets."${name}-pass".path;
        allow-flight = false;
        allow-nether = true;
        difficulty = 2;
        enable-command-block = false;
        enable-rcon = true;
        enable-status = true;
        force-gamemode = true;
        gamemode = 0;
        generate-structures = true;
        hardcore = false;
        hide-online-players = false;
        level-name = "Brix on Nix";
        level-seed = "9064150133272194";
        max-players = 10;
        max-world-size = 64000000;
        motd = "A cool Minecraft server powered by NixOS";
        online-mode = true;
        pvp = true;
        server-port = ports.port0;
        spawn-animals = true;
        spawn-monsters = true;
        spawn-npcs = true;
        spawn-protection = 16;
        view-dtstance = 32;
        white-list = true;
      };
      whitelist = {
        Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
        Hefty_Chungus_Jr = "c3bf8cac-e953-4ea4-ae5f-7acb92a51a85";
        EclipseMoon01 = "adef4af7-d8c6-4627-b492-e990ea1bb993";
        Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
      };
    };
  };
  sops = let
    sopsSecrets = ["pass"];
    sopsPath = secret: {
      path = "${sops.path0}/${name}-${secret}";
      owner = name;
      mode = "600";
    };
  in {
    secrets = builtins.listToAttrs (
      map
      (secret: {
        name = "${name}-${secret}";
        value = sopsPath secret;
      })
      sopsSecrets
    );
  };

  fileSystems."/var/lib/${name}" = {
    device = paths.path0;
    fsType = "none";
    options = ["bind"];
    depends = [server.storage0.mount];
  };

  systemd.tmpfiles.rules = [
    "Z ${paths.path0} 0755 ${name} ${name} -"
    "Z ${sops.path0} 0755 ${name} ${name} -"
  ];

  networking = {
    firewall = {
      allowedTCPPorts = [
        ports.port0
      ];
    };
  };
}