{
  config,
  lib,
  pkgs,
  ...
}:
with lib; let
  cfg = config.services.piped;
in {
  options.services.piped = {
    enable = mkEnableOption "piped";

    frontendDomain = mkOption {type = types.str;};
    backendDomain = mkOption {
      type = types.nullOr types.str;
      default = null;
      description = "Set to null to use project default backend";
    };
    proxyDomain = mkOption {type = types.str;};
    #rydProxyDomain = mkOption { type = types.str; };

    disableFrontend = mkOption {
      type = types.bool;
      default = false;
      description = "Don't host frontend";
    };

    disableBackend = mkOption {
      type = types.bool;
      default = false;
      description = "Don't host backend";
    };

    disableProxy = mkOption {
      type = types.bool;
      default = false;
      description = "Don't host proxy";
    };

    proxyIPv4Only = mkOption {
      type = types.bool;
      default = false;
      description = "Only use IPv4 querying youtube's servers for proxy";
    };

    httpWorkers = mkOption {
      type = types.number;
      default = 2;
      description = "Number of workers for HTTP backend tasks";
    };

    feedRetentionDays = mkOption {
      type = types.number;
      default = 30;
      description = "Days feed is stored for";
    };

    subscriptionRetentionDays = mkOption {
      type = types.number;
      default = 30;
      description = "Days subscriptions are stored for unauthenticated users";
    };

    sponsorblockServers = mkOption {
      type = types.listOf types.str;
      default = ["https://sponsor.ajay.app" "https://sponsorblock.kavin.rocks"];
      description = "Days subscriptions are stored for unauthenticated users";
    };

    disableRegistrations = mkOption {
      type = types.bool;
      default = true;
      description = "Disable user registrations";
    };

    disableLBRYStreams = mkOption {
      type = types.bool;
      default = false;
      description = "Disable showing streams provided by LBRY Youtube Partnership";
    };

    enableCompromisedPasswordCheck = mkOption {
      type = types.bool;
      default = true;
      description = "Use the haveibeenpwned API to check if user password have been compromised";
    };

    enableCaptcha = mkOption {
      type = types.bool;
      default = true;
      description = "Enable captcha for registrations";
    };

    sentryDSN = mkOption {
      type = types.str;
      default = "";
      description = "Public DSN for sentry error reporting";
    };

    captchaAPIURL = mkOption {
      type = types.str;
      default = "";
      description = "API URL for Captcha";
    };

    # TODO: Key & KeyFile should be only one or the other used

    captchaAPIKey = mkOption {
      type = types.str;
      default = "";
      description = "API Key for Captcha";
    };

    captchaAPIKeyFile = mkOption {
      type = types.str;
      default = "";
      description = "API Key File for Captcha";
    };

    # TODO: run this, requires a go app and Tor server for proxy
    #enableRYDServer = mkOption {
    #  type = types.bool;
    #  default = true;
    #  description = "Run a RYD Proxy Server to use";
    #};

    disableRYD = mkOption {
      type = types.bool;
      #default = if cfg.enableRYDServer then false else true;
      default = false;
      description = "Disables querying a Return YouTube Dislike server";
    };

    rydAPIURL = mkOption {
      type = types.str;
      #default = if cfg.enableRYDServer then cfg.rydProxyDomain else "https://ryd-proxy.kavin.rocks";
      default = "https://ryd-proxy.kavin.rocks";
      description = "API URL for a Return YouTube Dislike server";
    };

    # for Piped's Federation Shenanigan
    # https://github.com/TeamPiped/piped-federation#how-to-join
    enableFederation = mkOption {
      type = types.bool;
      default = false;
      description = "Enable federation of something";
    };

    matrixServerAddr = mkOption {
      type = types.str;
      default = "";
      description = "Matrix server address for federation";
    };

    # TODO: make so only one of these options can be used
    matrixToken = mkOption {
      type = types.str;
      default = "";
      description = "Matrix access token";
    };

    matrixTokenFile = mkOption {
      type = types.str;
      default = "";
      description = "Matrix access token file";
    };

    internalBackendPort = mkOption {
      type = types.number;
      default = 3001;
    };

    internalProxyPort = mkOption {
      type = types.number;
      default = 3002;
    };
  };

  config = mkIf (cfg.enable && (!cfg.disableBackend || !cfg.disableProxy)) {
    users.users."piped" = {
      isSystemUser = true;
      group = "piped";
    };
    users.groups.piped = {};
  };
}