{
  config,
  lib,
  pkgs,
  customPkgs,
  ...
}:
let
  cfg = config.services.server-autodeploy;
in
{
  options.services.server-autodeploy = {
    enable = lib.mkEnableOption "automatic deployment from signed git tags";

    interval = lib.mkOption {
      type = lib.types.str;
      default = "15min";
    };

    branch = lib.mkOption {
      type = lib.types.str;
      default = "master";
    };

    giteaUrl = lib.mkOption {
      type = lib.types.str;
    };

    giteaRepo = lib.mkOption {
      type = lib.types.str;
    };

    tokenFile = lib.mkOption {
      type = lib.types.str;
    };

    allowedSigners = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = [ ];
    };

    stateDir = lib.mkOption {
      type = lib.types.str;
    };
  };

  config = lib.mkIf cfg.enable {
    systemd.services.server-autodeploy = {
      description = "Deploy latest signed tag";
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];

      environment = {
        GITEA_URL = cfg.giteaUrl;
        GITEA_REPO = cfg.giteaRepo;
        TOKEN_FILE = cfg.tokenFile;
        ALLOWED_SIGNERS = builtins.toFile "signers" (lib.join "\n" cfg.allowedSigners);
        DEPLOY_BRANCH = cfg.branch;
        STATE_DIR = cfg.stateDir;
        REPO_DIR = "/persist/@configuration";
      };

      serviceConfig = {
        Type = "oneshot";
        ExecStart = lib.getExe customPkgs.server-autodeploy;
        TimeoutStartSec = "30min";
      };

      path = [
        config.nix.package
        pkgs.nixos-rebuild
      ];
    };

    systemd.timers.server-autodeploy = {
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnBootSec = "2min";
        OnUnitActiveSec = cfg.interval;
        RandomizedDelaySec = "2min";
      };
    };
  };
}