{
  config,
  lib,
  nixpkgs,
  ...
}:

let
  EnvironmentFile = [ config.age.secrets."netbox-environment_file".path ];
in

{
  services = {
    netbox = {
      enable = true;
      package = nixpkgs.unstable.netbox_4_1;
      secretKeyFile = "/dev/null";
      listenAddress = "127.0.0.1";
      plugins = p: [ p.netbox-qrcode ];
      settings = {
        ALLOWED_HOSTS = [ "netbox.dgnum.eu" ];
        REMOTE_AUTH_BACKEND = "social_core.backends.open_id_connect.OpenIdConnectAuth";
        PLUGINS = [ "netbox_qrcode" ];
        PLUGINS_CONFIG = {
          netbox_qrcode = {
            custom_text = "DGNum. contact@dgnum.eu";
            font = "Tahoma";
          };
        };
      };

      extraConfig = lib.mkForce ''
        from os import environ as env

        SECRET_KEY = env["SECRET_KEY"]

        SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = env["NETBOX_OIDC_URL"]
        SOCIAL_AUTH_OIDC_KEY = env["NETBOX_OIDC_KEY"]
        SOCIAL_AUTH_OIDC_SECRET = env["NETBOX_OIDC_SECRET"]
      '';
    };
  };

  systemd.services = {
    netbox.serviceConfig = {
      inherit EnvironmentFile;

      TimeoutStartSec = 600;
    };

    netbox-housekeeping.serviceConfig = {
      inherit EnvironmentFile;
    };

    netbox-rq.serviceConfig = {
      inherit EnvironmentFile;
    };
  };

  users.users.nginx.extraGroups = [ "netbox" ];

  dgn-web.simpleProxies.netbox = {
    inherit (config.services.netbox) port;
    host = "netbox.dgnum.eu";
    vhostConfig.locations."/static/".alias = "${config.services.netbox.dataDir}/static/";
  };

  dgn-backups.jobs.netbox.settings.paths = [ "/var/lib/netbox" ];
  dgn-backups.postgresDatabases = [ "netbox" ];
}