{
  config,
  lib,
  pkgs,
  ...
}: let
  serviceName = "snipe-it";
  servicePort = config.m3ta.ports.get serviceName;
  mysqlPort = config.m3ta.ports.get "mysql";
  hostName = "am.az-gruppe.com";

  restoreDefaults = pkgs.writeShellScript "snipe-it-restore-defaults" ''
    set -euo pipefail
    src="${pkgs.snipe-it}/share/snipe-it/uploads"
    dst="/var/lib/snipe-it/public/uploads"

    if [ -d "$src" ] && [ -d "$dst" ]; then
      # -n = kein Überschreiben existierender Dateien (User-Uploads bleiben erhalten)
      cp -rn "$src/." "$dst/"
    fi
  '';
in {
  services.${serviceName} = {
    enable = true;
    inherit hostName;
    appURL = "https://${hostName}";
    appKeyFile = config.age.secrets.snipe-it-app-key.path;

    database = {
      host = "127.0.0.1";
      port = mysqlPort;
      name = "snipeit";
      user = "snipeit";
      passwordFile = config.age.secrets.snipe-it-db-password.path;
      createLocally = false;
    };

    mail = {
      driver = "smtp";
      host = "smtp.eu.mailgun.org";
      port = 587;
      encryption = "tls";
      user = "bot@az-gruppe.com";
      passwordFile = config.age.secrets.snipe-it-mail-password.path;
      from = {
        name = "AZ - Asset Management";
        address = "bot@az-gruppe.com";
      };
      replyTo = {
        name = "Snipe-IT Asset Management";
        address = "bot@az-gruppe.com";
      };
      backupNotificationAddress = "sascha.koenig@azintec.com";
    };

    nginx.listen = [
      {
        addr = "127.0.0.1";
        port = servicePort;
      }
    ];

    config = {
      APP_TRUSTED_PROXIES = "127.0.0.1";
      SECURE_COOKIES = lib.mkForce true;
    };
  };

  systemd.services.snipe-it-setup = {
    after = ["mysql.service"];
    requires = ["mysql.service"];
    unitConfig.ConditionPathExists = "${config.services.mysql.dataDir}/snipeit";
    serviceConfig = {
      ExecStartPre = ["+${restoreDefaults}"];
    };
  };

  # Traefik configuration
  services.traefik.dynamicConfigOptions.http = {
    services.${serviceName}.loadBalancer.servers = [
      {
        url = "http://localhost:${toString servicePort}/";
      }
    ];

    routers.${serviceName} = {
      rule = "Host(`${hostName}`)";
      tls = {
        certResolver = "ionos";
      };
      service = serviceName;
      entrypoints = "websecure";
    };
  };
}