{ config, lib, ... }:
{
  sops = {
    secrets = {
      "pds/adminPass" = { };
      "pds/jwtSecret" = { };
      "pds/plcRotKey" = { };
      "pds/smtpUrl" = { };
    };
    templates.pds-env.content =
      let
        adminPass = config.sops.placeholder."pds/adminPass";
        jwtSecret = config.sops.placeholder."pds/jwtSecret";
        plcRotKey = config.sops.placeholder."pds/plcRotKey";
        smtpUrl = config.sops.placeholder."pds/smtpUrl";
      in
      ''
        PDS_JWT_SECRET=${jwtSecret}
        PDS_ADMIN_PASSWORD=${adminPass}
        PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=${plcRotKey}
        PDS_EMAIL_SMTP_URL=${smtpUrl}
      '';
  };

  services.bluesky-pds = {
    enable = true;
    pdsadmin.enable = true;
    settings = {
      PDS_HOSTNAME = "pds.monke.moe";
      PDS_EMAIL_FROM_ADDRESS = "pds@monke.moe";
      PDS_CONTACT_EMAIL_ADDRESS = "monke@monke.moe";
      PDS_SERVICE_HANDLE_DOMAINS = ".monke.moe,.moe";
      NODE_OPTIONS = "--network-family-autoselection-attempt-timeout=500";
    };
    environmentFiles = [ config.sops.templates.pds-env.path ];
  };

  forest.nginxHosts = [
    (lib.mkIf config.services.bluesky-pds.enable {
      "pds.monke.moe" = {
        onlySSL = true;
        useACMEHost = "monke.moe";
        http2 = true;
        locations."/" = {
          proxyPass = "http://127.0.0.1:3000";
          proxyWebsockets = true;
        };
      };
      "shinx579.monke.moe" = {
        onlySSL = true;
        useACMEHost = "monke.moe";
        http2 = true;
        locations."/.well-known/atproto-did" = {
          return = "200 did:plc:faj3ti5nppn6hyyq67faej6k";
          extraConfig = ''
            add_header Access-Control-Allow-Origin "*" always;
            add_header Content-Type "text/plain" always;
          '';
        };
      };
    })
  ];
}