{
  config,
  inputs,
  pkgs,
  lib,
  self,
  ...
}:
let

  d = self.lib.data.services.iceshrimp;

  package = inputs.iceshrimp.packages.x86_64-linux.iceshrimp-pre.overrideAttrs rec {
    version = "2023.12.8-pyrox1";
    src = pkgs.fetchgit {
      url = "https://iceshrimp.dev/pyrox/iceshrimp";
      hash = "sha256-hxZ3rVVAiAMFAYhZ2o+WhlMuhjbt5EyHKOl1VyyL5RA=";
      rev = "v${version}";
      fetchLFS = true;
      deepClone = false;
    };
    patches = [ ];
  };
in
{
  services.iceshrimp = {
    inherit package;
    enable = false;
    secretConfig = config.age.secrets.iceshrimp-secret-config.path;
    dbPasswordFile = config.age.secrets.iceshrimp-db-password.path;
    createDb = true;
    configureNginx.enable = false;
    settings = {
      inherit (d) port;
      url = "https://${d.extUrl}";
      accountDomain = "pyrox.dev";
      redis.port = 6997;
      maxNoteLength = 16384;
      maxCaptionLength = 8192;
      clusterLimit = 4;
      deliverJobConcurrency = 192;
      inboxJobConcurrency = 32;
      deliverJobPerSec = 256;
      inboxJobPerSec = 32;
      outgoingAddressFamily = "dual";
      # See the withdrawal patches for obliterate info
      enableObliterate = true;
      obliterateJobPerSec = 16;
      obliterateJobMaxAttempts = 3;
      mediaCleanup = {
        cron = true;
        maxAgeDays = 30;
        cleanAvatars = true;
        cleanHeaders = true;
      };
      htmlCache = {
        ttl = "6h";
        prewarm = true;
        dbFallback = true;
      };
      wordMuteCache.ttl = "24h";
      isManagedHosting = true;
      email = {
        managed = true;
        address = "social@pyrox.dev";
        host = "mail.pyrox.dev";
        port = 465;
        user = "social@pyrox.dev";
        useImplicitSslTls = true;
      };
      objectStorage = {
        managed = true;
        baseUrl = "https://pool.jortage.com/socialpyroxdev";
        bucket = "socialpyroxdev";
        prefix = "mkmedia";
        endpoint = "pool-api.jortage.com";
        region = "jort";
        useSsl = true;
        connnectOverProxy = false;
        setPublicReadOnUpload = false;
        s3ForcePathStyle = true;
      };
    };
  };
  age.secrets = lib.mkIf config.services.iceshrimp.enable {
    iceshrimp-secret-config = {
      inherit (config.services.iceshrimp) group;
      file = ./secrets/iceshrimp-secret-config.age;
      owner = config.services.iceshrimp.user;
    };
    iceshrimp-db-password = {
      file = ./secrets/iceshrimp-db-password.age;
      owner = "postgres";
      group = "postgres";
    };
  };
}