{
  config,
  lib,
  pkgs,
  ...
}: let
  port = 3456;
  user = "vikunja";
  db = "vikunja";

  redisPort = 3279;
in {
  sops.secrets."vikunja/jwtSecret" = {
    owner = user;
    group = user;
  };
  sops.secrets."vikunja/oidcSecret" = {
    owner = user;
    group = user;
  };

  sops.templates."vikunja/config" = {
    owner = user;
    file = (pkgs.formats.yaml {}).generate "config.yaml" {
      database = {
        type = "postgres";
        host = "/run/postgresql";
        user = user;
        database = db;
      };
      files.basepath = "/var/lib/vikunja/files";

      service = {
        jwtsecret = "${config.sops.placeholder."vikunja/jwtSecret"}";
        interface = ":${toString port}";
        publicurl = "https://todo.liljamo.com";
        enableregistration = false;
        timezone = "Europe/Helsinki";
      };
      redis = {
        enabled = true;
        host = "127.0.0.1:${toString redisPort}";
      };
      keyvalue.type = "redis";
      auth = {
        local.enabled = false;
        openid = {
          enabled = true;
          providers = [
            {
              name = "Liljamo Auth";
              authurl = "https://auth.liljamo.com";
              clientid = "vikunja";
              clientsecret = "${config.sops.placeholder."vikunja/oidcSecret"}";
            }
          ];
        };
      };
      #metrics.enabled = true; # TODO: https://vikunja.io/docs/config-options/#0--metrics
      #       also same as jellyfin and miniflux, make this not available via haproxy
      defaultsettings = {
        week_start = 1; # Monday
      };
    };
  };

  networking.firewall.allowedTCPPorts = [port];

  services.vikunja = {
    enable = true;
    # NOTE: These are not actually used, they're here just to make the module happy.
    frontendHostname = "todo.liljamo.com";
    frontendScheme = "https";
  };

  environment.etc."vikunja/config.yaml".source = lib.mkForce config.sops.templates."vikunja/config".path;

  services.postgresql = {
    ensureDatabases = [db];
    ensureUsers = [
      {
        name = user;
        ensureDBOwnership = true;
      }
    ];
  };

  services.redis.servers.vikunja = {
    enable = true;
    bind = "127.0.0.1";
    port = redisPort;
  };

  users.users.${user} = {
    createHome = false;
    group = user;
    isSystemUser = true;
  };
  users.groups.${user} = {};

  systemd.services.vikunja.serviceConfig = {
    DynamicUser = lib.mkForce false;
    User = user;
    Group = user;
  };
}