{
  config,
  pkgs,
  lib,
  ...
}:
with lib; let
  name = "splunk";
  cfg = config.services.itd."${name}";

  package = pkgs.callPackage ./package.nix {};
in {
  imports = [];

  options.services.itd."${name}" = {
    enable = mkEnableOption "ITD Splunk";

    user = {
      user = mkOption {
        type = types.str;
        default = "splunk";
      };
      group = mkOption {
        type = types.str;
        default = "splunk";
      };

      home = mkOption {
        type = types.str;
        default = "/etc/itd/splunk";
      };
    };
  };

  config = mkIf cfg.enable {
    # create user and group for the program
    users.groups."${cfg.user.group}" = {};
    users.users."${cfg.user.user}" = {
      createHome = true;
      isNormalUser = true;
      home = cfg.user.home;
      group = cfg.user.group;
      # X11 is to ensure the directory can be traversed
      homeMode = "711";
    };

    # might not be required
    #    networking.firewall.allowedTCPPorts = [8089];

    # set up the core files
    systemd.services."${name}_prestart" = {
      wantedBy = [
        #      "gitlab.target"
      ];
      partOf = [
        #      "gitlab.target"
      ];
      path = with pkgs; [util-linux];
      serviceConfig = {
        Type = "oneshot";
        User = "root";
        Group = "root";
        #        User = cfg.user.user;
        #        Group = cfg.user.group;
        #        TimeoutSec = "infinity";
        #        Restart = "on-failure";
        #        WorkingDirectory = "${cfg.package}/share/gitlab";
        #        Slice = "system-gitlab.slice";
        RemainAfterExit = true;
        ExecStart = let
          # from $SPLUNK_HOME/etc/splunk-launch.conf.default
          splunk_launch = pkgs.writeText "splunk-launch" ''
            SPLUNK_HOME=${cfg.user.home}
            SPLUNK_SERVER_NAME=SplunkForwarder
            PYTHONHTTPSVERIFY=0
            PYTHONUTF8=1
          '';

          etc_passwd = pkgs.writeText "passwd" ''
            :admin:$6$XOFhpq0Y1Ul1pejO$DUkXU6xSAKYrl3nLTPFS7LJqlnWC4r97SSikjCzv7XNEG6lgP32TZHyLDY/aJs8ZYyblZ5spfmnlMvh8Lxndi/::Administrator:admin:changeme@example.com:::20329
          '';

          deployment_client = pkgs.writeText "deploymentclient" ''
            [deployment-client]
            clientName = UL_client
            [target-broker:deploymentServer]
            targetUri = soc-deployment.heanet.ie:8089
          '';
        in
          pkgs.writeShellScript "splunk-config" ''
            set -o errexit -o pipefail -o nounset
            shopt -s inherit_errexit

            umask u=rwx,g=rx,o=

            # start with a clean slate, it yells at ye if ye try to boot it up without doing this
            rm -rf ${cfg.user.home}/*

            chmod 771 -R ${cfg.user.home}

            # pull in all relevent files
            cp -f -R ${package}/* ${cfg.user.home}

            chmod 771 -R ${cfg.user.home}
            chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home}

            # if [ ! -f ${cfg.user.home}/etc/splunk-launch.conf ]; then
              export SPLUNK_HOME=${cfg.user.home}

              cp ${splunk_launch} $SPLUNK_HOME/etc/splunk-launch.conf

              cp ${etc_passwd} $SPLUNK_HOME/etc/passwd

              # ensure the dir exists
              mkdir -p $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/
              cp ${deployment_client} $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/deploymentclient.conf


              # Splunk is doing a crime by deciding what teh path is, need to comment out this line
              # in /bin/pid_check.sh
              # PATH=/usr/xpg4/bin:/usr/bin:/bin
              # PATH=
              sed -i -e 's/PATH=/#PATH=/g' ${cfg.user.home}/bin/pid_check.sh

              # make sure user permissions are correct
              chmod 771 -R ${cfg.user.home}
              chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home}

              # run it to see if that works
              runuser -u ${cfg.user.user} -- $SPLUNK_HOME/bin/splunk start --accept-license

              # $SPLUNK_HOME/bin/splunk enable boot-start
              # /etc/systemd/system/multi-user.target.wants/SplunkForwarder.service
            # fi
          '';
      };
    };

    systemd.services."${name}" = {
      wantedBy = [
      ];
      requires = [
        "${name}_prestart.service"
      ];
      path = with pkgs; [util-linux toybox];
      serviceConfig = {
        Type = "oneshot";
        User = cfg.user.user;
        Group = cfg.user.group;
        TimeoutSec = "infinity";
        Restart = "on-failure";
        #        WorkingDirectory = "${cfg.package}/share/gitlab";
        #        Slice = "system-gitlab.slice";
        RemainAfterExit = true;

        Environment = "SPLUNK_HOME=${cfg.user.home}";
        ExecStart = "${package}/bin/splunk  _internal_launch_under_systemd";

        # no so sure about these
        NoNewPrivileges = "yes";
        AmbientCapabilities = "CAP_DAC_READ_SEARCH";
      };
    };
  };
}