{ config, lib, pkgs, ... }:
let
  cfg = config.services.zrepl;
in
{
  options = {
    services.zrepl = {
      enable = lib.mkEnableOption "Enable the zrepl daemon";

      config = lib.mkOption {
        type = lib.types.lines;
        default = "";
        description = "Configuration";
      };
    };
  };

  config = lib.mkIf cfg.enable {
    secrets.keys = [
      {
        dest = "zrepl/zrepl.yml";
        permissions = "0400";
        text = cfg.config;
        user = config.systemd.services.zrepl.serviceConfig.User or "root";
        group = config.systemd.services.zrepl.serviceConfig.Group or "root";
      }
    ];
    services.filesWatcher.zrepl = {
      restart = true;
      paths = [ config.secrets.fullPaths."zrepl/zrepl.yml" ];
    };
    systemd.services.zrepl = {
      description = "zrepl daemon";
      wantedBy = [ "multi-user.target" ];
      path = [ pkgs.zfs pkgs.openssh ];
      serviceConfig = {
        ExecStart =
          let configFile = config.secrets.fullPaths."zrepl/zrepl.yml";
          in "${pkgs.zrepl}/bin/zrepl daemon --config ${configFile}";
        Type = "simple";
        RuntimeDirectory= "zrepl";
        RuntimeDirectoryMode= "0700";
      };
    };
  };
}