let
  snipeit-fqdn = "snipe-it.nixos.local";
in
{ pkgs, ... }:
{
  services.snipe-it = {
    enable = true;
    appKeyFile = "/etc/nixos/secrets/snipe-it/appkey";
    appURL = "https://${snipeit-fqdn}";
    hostName = snipeit-fqdn;
    database = {
      user = "snipeit";
    };
    nginx = {
      sslCertificate = "/etc/nixos/secrets/certs/snipe-it.nixos.local.crt";
      sslCertificateKey = "/etc/nixos/secrets/certs/snipe-it.nixos.local.key";
      forceSSL = true;
      kTLS = true;
    };
  };
  services.mysql = {
    enable = true;
    package = pkgs.mariadb;
    ensureUsers = [
      {
        name = "snipeit";
        ensurePermissions = {
          "snipeit.*" = "ALL PRIVILEGES";
        };
      }
    ];
    ensureDatabases = [ "snipeit" ];
  };
}