{
  config,
  pkgs,
  ...
}: let
  akkomaPort = 4000;
in {
  networking.firewall.allowedTCPPorts = [akkomaPort];

  services.postgresql = {
    package = pkgs.postgresql_16;
    enable = true;
    ensureDatabases = ["akkoma"];
    ensureUsers = [
      {
        name = "akkoma";
        ensureDBOwnership = true;
      }
    ];
  };

  services.akkoma = {
    enable = true;
    user = "akkoma";
    group = "akkoma";
    config = {
      ":pleroma" = {
        ":instance" = {
          description = "Personal instance";
          email = "jonni@liljamo.com"; # FIXME: maybe abuse@liljamo.com?
          name = "Lothlórien";
          registrations_open = false;
        };

        "Pleroma.Repo" = {
          adapter = (pkgs.formats.elixirConf {}).lib.mkRaw "Ecto.Adapters.Postgres";
          socket_dir = "/run/postgresql";
          username = config.services.akkoma.user;
          database = "akkoma";
        };

        # FIXME: different subdomain as recommended
        "Pleroma.Upload".base_url = "https://lothlorien.social/media/";

        "Pleroma.Web.Endpoint".http.ip = "0.0.0.0";
        "Pleroma.Web.Endpoint".http.port = akkomaPort;

        "Pleroma.Web.Endpoint".url.host = "lothlorien.social";
        "Pleroma.Web.Endpoint".url.port = 443;
      };
    };
  };

  system.stateVersion = "24.05";
}