{
  config,
  lib,
  pkgs,
  inputs,
  ...
}:
{
  options = {
    myService.taskline.enable = lib.mkEnableOption "enable taskline Service";
  };

  config = lib.mkIf config.myService.taskline.enable {
    sops.secrets = {
      nuxt_google_client_id = { };
      nuxt_google_client_secret = { };
      better_auth_secret = { };

      api_webpush_private_key = { };
    };

    sops.templates."taskline.nuxt.env".content = ''
      NUXT_GOOGLE_CLIENT_ID=${config.sops.placeholder.nuxt_google_client_id}
      NUXT_GOOGLE_CLIENT_SECRET=${config.sops.placeholder.nuxt_google_client_secret}

      BETTER_AUTH_SECRET=${config.sops.placeholder.better_auth_secret}
    '';

    sops.templates."taskline.api.env".content = ''
      API_WEBPUSH_PRIVATE_KEY=${config.sops.placeholder.api_webpush_private_key}
    '';

    users.users.taskline-storage = {
      isSystemUser = true;
      group = "taskline-storage";
    };
    users.groups.taskline-storage = { };

    systemd.services.taskline-backend = {
      description = "TaskLine Backend";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

      environment = {
        PORT = "3001";
        API_DATABASE_URL = "postgresql://taskline-storage@localhost/taskline-storage?host=/run/postgresql";

        API_AUTH_API_BASE = "https://taskline.tobinio.dev";
        API_SELF_API_BASE = "https://taskline-api.tobinio.dev";
      };

      serviceConfig = {
        ExecStart = "${inputs.taskline.packages.${pkgs.system}.backend-postgres}/bin/api";

        EnvironmentFile = config.sops.templates."taskline.api.env".path;

        User = "taskline-storage";

        Restart = "always";
        RestartSec = 5;

        ProtectSystem = "strict";
        ProtectHome = true;
        NoNewPrivileges = true;
        PrivateTmp = true;

        ReadWritePaths = [
          "/srv/apps/taskline/data"
        ];
      };
    };

    systemd.services.taskline-frontend = {
      description = "TaskLine Frontend";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

      environment = {
        PORT = "3003";
        HOST = "0.0.0.0";

        BETTER_AUTH_URL = "https://taskline.tobinio.dev";

        NUXT_PUBLIC_WEBPUSH_PUBLIC_KEY = "BEOF0yspWooXO5VJisweKxnXrbdOreIRoBKpNqqbqzeZW5tMdVU6vzJ5AUeJV3iovr6NTYgL2Kp4OHum0JG3y6M";
        NUXT_PUBLIC_API_BASE = "https://taskline-api.tobinio.dev";

        BETTER_AUTH_DATABASE_PATH = "/srv/apps/taskline/data/auth.sqlite";
      };

      serviceConfig = {
        ExecStart = "${pkgs.nodejs_24}/bin/node ${
          inputs.taskline.packages.${pkgs.system}.frontend
        }/server/index.mjs";

        EnvironmentFile = config.sops.templates."taskline.nuxt.env".path;

        Restart = "always";
        RestartSec = 5;

        ProtectSystem = "strict";
        ProtectHome = true;
        NoNewPrivileges = true;
        PrivateTmp = true;

        ReadWritePaths = [
          "/srv/apps/taskline/data"
        ];
      };
    };
  };
}