{
  config,
  lib,
  ...
}: let
  serviceName = "semaphore";
  servicePort = config.m3ta.ports.get serviceName;
in {
  virtualisation.oci-containers.containers."${serviceName}" = {
    image = "docker.io/semaphoreui/semaphore:latest";
    environment = {
      SEMAPHORE_DB_DIALECT = "postgres";
      SEMAPHORE_DB_HOST = "postgres";
      SEMAPHORE_DB_PORT = "5432";
      SEMAPHORE_PLAYBOOK_PATH = "/tmp/semaphore/";
    };
    environmentFiles = [config.age.secrets.semaphore-env.path];
    ports = ["127.0.0.1:${toString servicePort}:3000"];
    volumes = [
      "semaphore_data:/var/lib/semaphore"
    ];
    extraOptions = [
      "--network=web:ip=10.89.0.17"
      "--network=vpn-egress"
      "--add-host=postgres:10.89.0.1"
      "--dns=8.8.8.8"
      "--dns=8.8.4.4"
    ];
  };

  networking.firewall.extraForwardRules = ''
    iifname "vpn-egress" oifname "wt0" accept
  '';

  systemd.services.semaphore-db-init = {
    description = "Provision semaphore role/database from agenix secret";
    after = ["postgresql.service"];
    before = ["podman-${serviceName}.service"];
    wants = ["postgresql.service"];
    wantedBy = ["multi-user.target"];
    serviceConfig = {
      Type = "oneshot";
      User = "postgres";
      Group = "postgres";
      RemainAfterExit = true;
    };
    path = [config.services.postgresql.package];
    script = ''
      set -euo pipefail
      ENV_FILE="${config.age.secrets.semaphore-env.path}"
      get_val() {
        grep -m1 "^$1=" "$ENV_FILE" | head -n1 | cut -d= -f2- | tr -d '\r'
      }
      db_name="$(get_val SEMAPHORE_DB)"
      db_user="$(get_val SEMAPHORE_DB_USER)"
      db_pass="$(get_val SEMAPHORE_DB_PASS)"
      if [ -z "$db_name" ] || [ -z "$db_user" ] || [ -z "$db_pass" ]; then
        echo "semaphore-db-init: SEMAPHORE_DB/SEMAPHORE_DB_USER/SEMAPHORE_DB_PASS missing in $ENV_FILE" >&2
        exit 1
      fi
      psql -v ON_ERROR_STOP=1 -d postgres \
        -v db_name="$db_name" -v db_user="$db_user" -v db_pass="$db_pass" <<'SQL'
      SELECT format('CREATE ROLE %I LOGIN', :'db_user')
      WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'db_user') \gexec
      ALTER ROLE :"db_user" WITH LOGIN PASSWORD :'db_pass';
      SELECT format('CREATE DATABASE %I OWNER %I', :'db_name', :'db_user')
      WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = :'db_name') \gexec
      ALTER DATABASE :"db_name" OWNER TO :"db_user";
      SQL
      echo "semaphore-db-init: role/database '$db_name' ready"
    '';
  };

  # Traefik configuration specific to semaphore
  services.traefik.dynamicConfigOptions.http = {
    services.${serviceName}.loadBalancer.servers = [{url = "http://localhost:${toString servicePort}/";}];

    routers.${serviceName} = {
      rule = "Host(`sem.l.az-gruppe.com`)";
      tls = {certResolver = "ionos";};
      service = serviceName;
      entrypoints = "websecure";
    };
  };
}