{ lib, pkgs, ... }:
let
  city-role-bot = pkgs.callPackage ../packages/city-role-bot.nix { };
in
{
  users.users.city-role-bot = {
    isSystemUser = true;
    group = "city-role-bot";
  };
  users.groups.city-role-bot = { };

  systemd.services.city-role-bot = {
    description = "city-role-bot";
    after = [ "network-online.target" ];
    wants = [ "network-online.target" ];
    wantedBy = [ "multi-user.target" ];

    environment.CITY_ROLE_BOT_DATA_DIR = "/var/lib/city-role-bot/data/";

    serviceConfig = {
      Type = "simple";
      User = "city-role-bot";
      Group = "city-role-bot";
      StateDirectory = "city-role-bot";
      WorkingDirectory = "/var/lib/city-role-bot";
      EnvironmentFile = "/var/lib/secrets/city-role-bot.env";
      ExecStart = lib.getExe city-role-bot;
      Restart = "on-failure";
      RestartSec = "5s";

      NoNewPrivileges = true;
      PrivateTmp = true;
      ProtectSystem = "strict";
      ProtectHome = true;
    };
  };
}