{
  config,
  repos,
  ...
}:
let
  enteConfig = config.services.snow.ente-web;
in
{
  services = {
    snow.ente-web = {
      enable = true;
      package = repos.unstable.ente-web;

      photosDomain = "ente.mrsnowy.dev";
      apiDomain = config.services.ente.api.domain;
      apiEndpoint = "localhost:${toString config.services.ente.api.settings.http.port}";

      domains = {
        "${enteConfig.photosDomain}" = "photos";
        "accounts.${enteConfig.photosDomain}" = "accounts";
        "albums.${enteConfig.photosDomain}" = "albums"; # for sharing albums
        "memories.${enteConfig.photosDomain}" = "memories"; # for sharing "memories"
        
        # "cast.${enteConfig.photosDomain}" = "cast"; # for casting to a TV
        # "embed.${enteConfig.photosDomain}" = "embed"; # for embedding pictures onto websites

        # "auth.${enteConfig.photosDomain}" = "auth";
        # "locker.${enteConfig.photosDomain}" = "locker";
        # "share.${enteConfig.photosDomain}" = "share";  # also for locker appearntly
        # "paste.${enteConfig.photosDomain}" = "paste";
      };
    };

    ente.api = {
      enable = true;
      package = repos.unstable.museum;
      domain = "api.ente.mrsnowy.dev";
      settings = {
        internal = {
          admins = [
            1580559962386438
          ];
          disable-registration = true;
        };

        http = {
          use-tls = false;
          port = config.ports.ente.api;
        };

        key = {
          encryption._secret = config.sops.secrets.ente_key_encryption.path;
          hash._secret = config.sops.secrets.ente_key_hash.path;
        };

        jwt = {
          secret._secret = config.sops.secrets.ente_jwt_secret.path;
        };

        jobs.clear-orphan-objects.enabled = true;

        apps = {
          public-albums = "https://albums.ente.mrsnowy.dev";
          public-locker = "https://share.ente.mrsnowy.dev";
          public-paste = "https://paste.ente.mrsnowy.dev";
          public-memories = "https://memories.ente.mrsnowy.dev";

          cast = "https://cast.ente.mrsnowy.dev";
          embed-albums = "https://embed.ente.mrsnowy.dev";
          accounts = "https://accounts.ente.mrsnowy.dev";
        };

        webauthn = {
          rpid = "127.0.0.1";
          rporigins = [
            "http://127.0.0.1:3001"
          ];
        };

        s3 = {
          are_local_buckets = false;
          use_path_style_urls = true;
          b2-eu-cen = {
            endpoint = "https://s3.mrsnowy.dev";
            region = "Europe-1";
            bucket = "ente-bucket";
            key._secret = config.sops.secrets.ente_s3_key.path;
            secret._secret = config.sops.secrets.ente_s3_secret.path;
          };
        };

        db = {
          host = "localhost";
          name = "ente_db";
          user = "ente";
          port = config.ports.pgdog;
          password._secret = config.sops.secrets.ente_db_password.path;
          sslmode = "disable";
        };
      };
    };
  };

  systemd.services.ente = {
    after = [
      "sops-install-secrets.service"
      "garage.service"
      "pgdog.service"
    ];
    wants = [
      "sops-install-secrets.service"
      "garage.service"
      "pgdog.service"
    ];
  };
}