{
  config,
  lib,
  ...
}: let
  serviceName = "snipe-it";
  servicePort = config.m3ta.ports.get serviceName;
  mysqlPort = config.m3ta.ports.get "mysql";
  hostName = "am.az-gruppe.com";
in {
  services.${serviceName} = {
    enable = true;
    inherit hostName;
    appURL = "https://${hostName}";
    appKeyFile = config.age.secrets.snipe-it-app-key.path;

    database = {
      host = "127.0.0.1";
      port = mysqlPort;
      name = "snipeit";
      user = "snipeit";
      passwordFile = config.age.secrets.snipe-it-db-password.path;
      createLocally = false;
    };

    mail = {
      from = {
        name = "Snipe-IT Asset Management";
        address = "snipe-it@az-gruppe.com";
      };
      replyTo = {
        name = "Snipe-IT Asset Management";
        address = "snipe-it@az-gruppe.com";
      };
      backupNotificationAddress = "sascha.koenig@azintec.com";
    };

    nginx.listen = [
      {
        addr = "127.0.0.1";
        port = servicePort;
      }
    ];

    config = {
      APP_TRUSTED_PROXIES = "127.0.0.1";
      SECURE_COOKIES = lib.mkForce true;
    };
  };

  systemd.services.snipe-it-setup = {
    after = ["mysql.service"];
    requires = ["mysql.service"];
    unitConfig.ConditionPathExists = "${config.services.mysql.dataDir}/snipeit";
  };

  # Traefik configuration
  services.traefik.dynamicConfigOptions.http = {
    services.${serviceName}.loadBalancer.servers = [
      {
        url = "http://localhost:${toString servicePort}/";
      }
    ];

    routers.${serviceName} = {
      rule = "Host(`${hostName}`)";
      tls = {
        certResolver = "ionos";
      };
      service = serviceName;
      entrypoints = "websecure";
    };
  };
}