{config, ...}: let
  serviceName = "n8n";
  servicePort = config.m3ta.ports.get serviceName;
in {
  services.${serviceName} = {
    enable = true;
    environment = {
      WEBHOOK_URL = "https://wf.az-gruppe.com";
      N8N_RUNNERS_ENABLED = true;
      N8N_NATIVE_PYTHON_RUNNER = true;
      N8N_RUNNERS_AUTH_TOKEN_FILE = config.age.secrets.n8n-runner-auth-token.path;
      NODE_FUNCTION_ALLOW_EXTERNAL = "*";
      N8N_RUNNERS_STDLIB_ALLOW = "*";
    };
    taskRunners = {
      enable = true;
      environment = {
        N8N_RUNNERS_STDLIB_ALLOW = "*";
      };
    };
  };

  systemd.services.${serviceName}.serviceConfig = {
    EnvironmentFile = config.age.secrets.n8n-env.path;
  };

  # Traefik configuration
  services.traefik.dynamicConfigOptions.http = {
    services.${serviceName}.loadBalancer.servers = [
      {
        url = "http://localhost:${toString servicePort}/";
      }
    ];

    routers.${serviceName} = {
      rule = "Host(`wf.az-gruppe.com`)";
      tls = {
        certResolver = "ionos";
      };
      service = serviceName;
      entrypoints = "websecure";
    };
  };
}