{
  config,
  pkgs,
  lib,
  ...
}:
with lib; let
  name = "splunk";
  cfg = config.services.itd."${name}";

  package = pkgs.callPackage ./package.nix {};
in {
  imports = [];

  options.services.itd."${name}" = {
    enable = mkEnableOption "ITD Splunk";

    user = {
      user = mkOption {
        type = types.str;
        default = "splunk";
      };
      group = mkOption {
        type = types.str;
        default = "splunk";
      };

      home = mkOption {
        type = types.str;
        default = "/etc/itd/splunk";
      };
    };
  };

  config = mkIf cfg.enable {
    # create user and group for the program
    users.groups."${cfg.user.group}" = {};
    users.users."${cfg.user.user}" = {
      createHome = true;
      isNormalUser = true;
      home = cfg.user.home;
      group = cfg.user.group;
      # X11 is to ensure the directory can be traversed
      homeMode = "711";
    };

    # might not be required
    networking.firewall.allowedTCPPorts = [8089];

    # need to set access controls
    systemd.tmpfiles.rules = [
      "a /var/log                 - - - - u:splunk:rx"
      "a /var/log/auth.log        - - - - u:splunk:r "
      "a /var/log/messages        - - - - u:splunk:r "
      "a /var/log/secure          - - - - u:splunk:r "
      "a /var/log/audit           - - - - u:splunk:rx"
      "a /var/log/audit.log       - - - - u:splunk:r "
      "a /var/log/audit/audit.log - - - - u:splunk:r "
      "a /root                    - - - - u:splunk:rx"
      "a /root/.bash_history      - - - - u:splunk:r "
      "a /home/*                  - - - - u:splunk:rx"
      "a /home/*/.bash_history    - - - - u:splunk:r "
    ];

    security.auditd = {
      enable = true;
      settings = {
        log_group = cfg.user.group;
      };
    };

    # set up the core files
    systemd.services."${name}_prestart" = {
      wantedBy = [
        #      "gitlab.target"
      ];
      partOf = [
        #      "gitlab.target"
      ];
      path = with pkgs; [util-linux];
      serviceConfig = {
        Type = "oneshot";
        User = "root";
        Group = "root";
        #        User = cfg.user.user;
        #        Group = cfg.user.group;
        #        TimeoutSec = "infinity";
        #        Restart = "on-failure";
        #        WorkingDirectory = "${cfg.package}/share/gitlab";
        #        Slice = "system-gitlab.slice";
        RemainAfterExit = true;
        ExecStart = let
          # from $SPLUNK_HOME/etc/splunk-launch.conf.default
          splunk_launch = pkgs.writeText "splunk-launch" ''
            SPLUNK_HOME=${cfg.user.home}
            SPLUNK_SERVER_NAME=SplunkForwarder
            PYTHONHTTPSVERIFY=0
            PYTHONUTF8=1
          '';

          etc_passwd = pkgs.writeText "passwd" ''
            :admin:$6$XOFhpq0Y1Ul1pejO$DUkXU6xSAKYrl3nLTPFS7LJqlnWC4r97SSikjCzv7XNEG6lgP32TZHyLDY/aJs8ZYyblZ5spfmnlMvh8Lxndi/::Administrator:admin:changeme@example.com:::20329
          '';

          deployment_client = pkgs.writeText "deploymentclient" ''
            [deployment-client]
            clientName = UL_client
            [target-broker:deploymentServer]
            targetUri = soc-deployment.heanet.ie:8089
          '';
        in
          pkgs.writeShellScript "splunk-config" ''
            set -o errexit -o pipefail -o nounset
            shopt -s inherit_errexit

            umask u=rwx,g=rx,o=

            # start with a clean slate, it yells at ye if ye try to boot it up without doing this
            rm -rf ${cfg.user.home}/*

            chmod 771 -R ${cfg.user.home}

            # pull in all relevent files
            cp -f -R ${package}/* ${cfg.user.home}

            chmod 771 -R ${cfg.user.home}
            chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home}

            # if [ ! -f ${cfg.user.home}/etc/splunk-launch.conf ]; then
              export SPLUNK_HOME=${cfg.user.home}

              cp ${splunk_launch} $SPLUNK_HOME/etc/splunk-launch.conf

              cp ${etc_passwd} $SPLUNK_HOME/etc/passwd

              # ensure the dir exists
              mkdir -p $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/
              cp ${deployment_client} $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/deploymentclient.conf

              # make sure user permissions are correct
              chmod 771 -R ${cfg.user.home}
              chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home}

              # run it to see if that works
              runuser -u ${cfg.user.user} -- $SPLUNK_HOME/bin/splunk start --accept-license

              # $SPLUNK_HOME/bin/splunk enable boot-start
              # /etc/systemd/system/multi-user.target.wants/SplunkForwarder.service
            # fi
          '';
      };
    };

    systemd.services."${name}" = {
      wantedBy = [
      ];
      requires = [
        "${name}_prestart.service"
      ];
      path = with pkgs; [util-linux toybox];
      serviceConfig = {
        Type = "simple";
        Restart = "always";
        Environment = "SPLUNK_HOME=${cfg.user.home}";
        ExecStart = "${package}/bin/splunk  _internal_launch_under_systemd";
        KillMode = "mixed";
        KillSignal = "SIGINT";
        TimeoutStopSec = 360;
        LimitNOFILE = 65536;
        LimitRTPRIO = 99;
        SuccessExitStatus = "51 52";
        RestartPreventExitStatus = 51;
        RestartForceExitStatus = 52;
        User = cfg.user.user;
        Group = cfg.user.group;
        NoNewPrivileges = "yes";
        AmbientCapabilities = "CAP_DAC_READ_SEARCH";

        # ExecStartPre=-/bin/bash -c "chown -R splunk:splunk /opt/splunkforwarder"
        Delegate = "true";
        #         CPUShares=1024;
        #         MemoryLimit=3973632000;
        PermissionsStartOnly = "true";
        # ExecStartPost=-/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/cpu/system.slice/%n"
        # ExecStartPost=-/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/memory/system.slice/%n"
      };
    };
  };
}