{ config, ... }:
let
  immichSecret = key: {
    sopsFile = ../secrets/immich.yaml;
    inherit key;
    owner = "immich";
  };
in
{
  sops.secrets."immich/oauth2/client-id" = immichSecret "immich/oauth2/client-id";
  sops.secrets."immich/oauth2/client-secret" = immichSecret "immich/oauth2/client-secret";

  services.immich = {
    enable = true;
    host = "0.0.0.0";
    port = 10040;

    mediaLocation = "/mnt/data/immich/media";
    openFirewall = true;
    machine-learning.enable = false;

    settings = {
      server.externalDomain = "https://i.mizuki.guru";
      machineLearning = {
        enabled = false;
      };
      oauth = {
        enabled = true;
        issuerUrl = "https://auth.mizuki.guru/application/o/immich/.well-known/openid-configuration";
        clientId._secret = config.sops.secrets."immich/oauth2/client-id".path;
        clientSecret._secret = config.sops.secrets."immich/oauth2/client-secret".path;
        scope = "openid email profile";
        buttonText = "Login with mizuki";
      };
    };
  };
}