{ pkgs, config, ... }:
let
  domain = "idm.oxapentane.com";
  kanidm-ip = "10.89.88.20";
  proxy-ip = "10.89.88.1";
in
{
  # mythic beasts cert
  sops.secrets = {
    "mythicbeasts-acme/api-id" = { mode = "0400"; };
    "mythicbeasts-acme/api-secret" = { mode = "0400"; };
  };

  security.acme = {
    acceptTerms = true;

    certs.${domain} = {
      dnsProvider = "mythicbeasts";
      credentialFiles = {
        MYTHICBEASTS_USERNAME_FILE = config.sops.secrets."mythicbeasts-acme/api-id".path;
        MYTHICBEASTS_PASSWORD_FILE = config.sops.secrets."mythicbeasts-acme/api-secret".path;
      };
      group = "kanidm";
      reloadServices = [
        "kanidm.service"
      ];
    };
  };

  # make sure cert exists before starting kanidm
  systemd.services.kanidm = {
    requires = [
      "acme-${domain}.service"
    ];
    after = [
      "acme-${domain}.service"
    ];
  };

  services.kanidm = {
    package = pkgs.kanidm_1_10;
    server = {
      enable = true;
      settings = {
        bindaddress = "${kanidm-ip}:8443";
        domain = domain;
        origin = "https://${domain}";
        tls_chain = "/var/lib/acme/${domain}/fullchain.pem";
        tls_key = "/var/lib/acme/${domain}/key.pem";
        http_client_address_info = {
          "x-forward-for" = [
            proxy-ip
          ];
        };

        online_backup = {
          path = "/var/lib/kanidm/backups";
          schedule = "00 03 * * *";
          versions = 31;
        };
      };
    };
    client = {
      enable = true;
      settings.uri = "https://${domain}";
    };
  };
}