{
  lib,
  pkgs,
  config,
  ...
}: let
  inherit (lib.strings) concatStringsSep;
  inherit (lib.lists) forEach;

  ports = import ../data/ports.nix;
  inherit (config.services.secrets) secrets;
in {
  environment.systemPackages = with pkgs; [
    mpc_cli
  ];

  systemd.tmpfiles.rules = [
    "d /Music - mpd mpd"
  ];

  systemd.services.mpd = {
    serviceConfig = {
      ReadOnlyPaths = "/Music";
    };
  };

  services.mpd = {
    enable = true;
    network.listenAddress = "0.0.0.0";
    musicDirectory = "/Music";
    dbFile = null;
    credentials = [
      {
        passwordFile = "${secrets.mpd_control_password.path}";
        permissions = ["read" "add" "control" "admin"];
      }
    ];
    extraConfig =
      ''
        host_permissions "127.0.0.1 read,add,control,admin"
        metadata_to_use "title,artist"
        auto_update "yes"
        audio_buffer_size "4096"
        replaygain "track"
        audio_output_format "48000:24:2"
        resampler {
          plugin "soxr"
          quality "very high"
          threads "0"
        }
        database {
            plugin "simple"
            path "/var/lib/mpd/db"
        }
      ''
      + concatStringsSep "\n" (forEach ["low" "medium" "high"] (quality: let
        bitrates = {
          "low" = "64";
          "medium" = "96";
          "high" = "128";
        };
        bitrate = bitrates.${quality};
      in ''
        audio_output {
          type "httpd"
          name "http (opus-${bitrate}k) /opus/${quality}"
          encoder "opus"
          port "${toString ports."mpd-opus-${quality}"}"
          bitrate "${bitrate}000"
          format "48000:24:2"
          always_on "yes"
          tags "yes"
          signal "music"
        }
      ''))
      + ''
        audio_output {
          type "httpd"
          name "http (flac) /flac"
          encoder "flac"
          port "${toString ports.mpd-flac}"
          format "48000:24:2"
          always_on "yes"
          tags "yes"
        }
      '';
  };
}