{
  hydrant-src,
  tangled-lexicons-src,
  lib,
  pkgs,
  ...
}: let
  port = 13010;
  lexiconFiles = dir: let
    entries = builtins.readDir dir;
  in
    lib.concatMap (
      name: let
        type = entries.${name};
        path = "${dir}/${name}";
      in
        if type == "directory"
        then lexiconFiles path
        else lib.optional (type == "regular" && lib.hasSuffix ".json" name) path
    ) (builtins.attrNames entries);
  lexicons =
    map
    (path: builtins.fromJSON (builtins.readFile path))
    (lexiconFiles "${tangled-lexicons-src}/lexicons");
  signals = lib.sort builtins.lessThan (
    map
    (lexicon: lexicon.id)
    (builtins.filter (lexicon: (lexicon.defs.main.type or null) == "record") lexicons)
  );
  hydrant = (pkgs.callPackage "${hydrant-src}/default.nix" {}).overrideAttrs {
    cargoBuildFeatures = ["jetstream"];
  };
in {
  users.groups.hydrant = {};
  users.users.hydrant = {
    isSystemUser = true;
    group = "hydrant";
  };

  systemd.services.hydrant = {
    description = "tangled atproto indexer and jetstream service";
    wantedBy = ["multi-user.target"];
    wants = ["network-online.target"];
    after = ["network-online.target"];

    environment = {
      HYDRANT_API_BIND = "127.0.0.1:${toString port}";
      HYDRANT_DATABASE_PATH = "/var/lib/hydrant/db";
      HYDRANT_RELAY_HOSTS = "";
      HYDRANT_SEED_HOSTS = "https://relay.fire.hose.cam,https://bsky.network";
      HYDRANT_CRAWLER_URLS = "list_repos::https://tngl.sh,by_collection::https://lightrail.microcosm.blue";
      HYDRANT_PLC_URL = "https://plc.directory";
      HYDRANT_FILTER_COLLECTIONS = "sh.tangled.*,org.tangled.*";
      HYDRANT_FILTER_SIGNALS = lib.concatStringsSep "," signals;
      HYDRANT_VERIFY_SIGNATURES = "full";
      HYDRANT_BACKFILL_CONCURRENCY_LIMIT = "2";
      HYDRANT_CRAWLER_MAX_PENDING_REPOS = "256";
      HYDRANT_CRAWLER_RESUME_PENDING_REPOS = "128";
      HYDRANT_CACHE_SIZE = "128";
      HYDRANT_DATA_COMPRESSION = "lz4";
      HYDRANT_DB_EVENTS_MEMTABLE_SIZE_MB = "16";
      HYDRANT_DB_RECORDS_MEMTABLE_SIZE_MB = "16";
      HYDRANT_DB_REPOS_MEMTABLE_SIZE_MB = "8";
      HYDRANT_DB_WORKER_THREADS = "1";
      HYDRANT_FIREHOSE_MAX_FAILURES = "3";
      HYDRANT_FIREHOSE_WORKERS = "1";
      HYDRANT_GET_REPO_CONCURRENCY_LIMIT = "1";
      HYDRANT_IDENTITY_CACHE_SIZE = "50000";
      HYDRANT_MAX_CAR_BODY_BYTES = "268435456";
      HYDRANT_PER_PDS_CONCURRENCY = "2";
      HYDRANT_OFFLINE_HOST_RETRY_INTERVAL = "6h";
      HYDRANT_STREAM_PENDING_EVENT_LIMIT = "1024";
      HYDRANT_RATE_TIERS = "tngl:9/0.0/32400/777600/10000000";
      HYDRANT_TIER_RULES = "tngl.sh:tngl";
      RUST_LOG = "info";
    };

    serviceConfig = {
      Type = "simple";
      ExecStart = "${hydrant}/bin/hydrant";
      Restart = "on-failure";
      RestartSec = "10s";
      User = "hydrant";
      Group = "hydrant";
      StateDirectory = "hydrant";
      StateDirectoryMode = "0750";
      WorkingDirectory = "/var/lib/hydrant";
      NoNewPrivileges = true;
      PrivateTmp = true;
      ProtectSystem = "strict";
      ProtectHome = true;
      LimitNOFILE = 1048576;
    };
  };
}