{ pkgs, unstable-pkgs, hydrant-src, ... }:
let
  hydrant = pkgs.callPackage (hydrant-src + "/default.nix") { };
in
{
  users.groups.stars = { };
  users.users.stars = {
    isSystemUser = true;
    group = "stars";
  };
  users.groups.stars-hydrant = { };
  users.users.stars-hydrant = {
    isSystemUser = true;
    group = "stars-hydrant";
  };

  systemd.services.stars-hydrant = {
    description = "Stars Hydrant indexer";
    after = [ "network-online.target" ];
    wants = [ "network-online.target" ];
    wantedBy = [ "multi-user.target" ];
    environment = {
      HYDRANT_DATABASE_PATH = "/var/lib/stars-hydrant/db";
      HYDRANT_API_BIND = "127.0.0.1:33991";
      HYDRANT_PLC_URL = "https://plc.cerulea.blue,https://plc.directory";
      HYDRANT_FULL_NETWORK = "false";
      HYDRANT_EPHEMERAL = "false";
      HYDRANT_ONLY_INDEX_LINKS = "false";
      HYDRANT_FILTER_SIGNALS = "site.hackery.stars.star,site.hackery.stars.follow";
      HYDRANT_FILTER_COLLECTIONS = "site.hackery.stars.star,site.hackery.stars.follow,app.bsky.actor.profile";
      HYDRANT_VERIFY_SIGNATURES = "full";
      HYDRANT_ENABLE_FIREHOSE = "true";
      HYDRANT_ENABLE_CRAWLER = "true";
      HYDRANT_RELAY_HOST = "wss://relay.fire.hose.cam/";
      HYDRANT_CRAWLER_URLS = "by_collection::https://lightrail.microcosm.blue";
      HYDRANT_BACKFILL_CONCURRENCY_LIMIT = "4";
      HYDRANT_CACHE_SIZE = "128";
      RUST_LOG = "warn";
    };
    serviceConfig = {
      Type = "simple";
      User = "stars-hydrant";
      Group = "stars-hydrant";
      StateDirectory = "stars-hydrant";
      StateDirectoryMode = "0700";
      WorkingDirectory = "/var/lib/stars-hydrant";
      ExecStart = "${hydrant}/bin/hydrant";
      Restart = "on-failure";
      RestartSec = "5s";
      NoNewPrivileges = true;
      PrivateTmp = true;
      ProtectSystem = "strict";
      ProtectHome = true;
    };
  };

  systemd.services.stars = {
    description = "Stars server";
    after = [ "network-online.target" "stars-hydrant.service" ];
    wants = [ "network-online.target" "stars-hydrant.service" ];
    wantedBy = [ "multi-user.target" ];
    unitConfig.ConditionPathExists = "/srv/apps/stars/main.ts";
    environment = {
      PUBLIC_URL = "https://stars.hackery.site";
      HYDRANT_URL = "http://127.0.0.1:33991";
      DATABASE_PATH = "/var/lib/stars/stars.sqlite";
      DENO_DIR = "/var/cache/stars/deno";
      HOME = "/var/lib/stars";
    };
    serviceConfig = {
      Type = "simple";
      User = "stars";
      Group = "stars";
      StateDirectory = "stars";
      StateDirectoryMode = "0700";
      CacheDirectory = "stars";
      CacheDirectoryMode = "0700";
      WorkingDirectory = "/srv/apps/stars";
      ExecStartPre = "${unstable-pkgs.deno}/bin/deno cache --lock=deno.lock main.ts";
      ExecStart = "${unstable-pkgs.deno}/bin/deno run --cached-only --allow-net --allow-env --allow-read=/srv/apps/stars,/var/lib/stars,/var/cache/stars --allow-write=/var/lib/stars,/var/cache/stars main.ts";
      Restart = "on-failure";
      RestartSec = "5s";
      NoNewPrivileges = true;
      PrivateTmp = true;
      ProtectSystem = "strict";
      ProtectHome = true;
    };
  };
}