{
  pkgs,
  ...
}:
let
  vars = import ../vars.nix;
  haproxy_ingest_server = pkgs.callPackage ../../../rust/haproxy_ingest_server/package.nix { };
in
{
  users = {
    groups.haproxy-ingest = { };
    users.haproxy-ingest = {
      isSystemUser = true;
      group = "haproxy-ingest";
    };
  };

  systemd = {
    services = {
      haproxy-ingest-server = {
        description = "HAProxy log ingestion API";
        documentation = [ "file://${../../../rust/haproxy_ingest_proto/README.md}" ];
        wantedBy = [ "multi-user.target" ];
        after = [
          "network-online.target"
          "postgresql.service"
          "tailscaled-autoconnect.service"
        ];
        wants = [
          "network-online.target"
          "postgresql.service"
          "tailscaled-autoconnect.service"
        ];

        serviceConfig = {
          Type = "simple";
          User = "haproxy-ingest";
          Group = "haproxy-ingest";
          ExecStart = "${haproxy_ingest_server}/bin/haproxy-ingest-server";
          Environment = [
            "HAPROXY_INGEST_DATABASE_URL=postgres://haproxy_ingest@localhost/haproxy_ingest?host=/run/postgresql&sslmode=disable"
            "HAPROXY_INGEST_LISTEN=0.0.0.0:8444"
            "RUST_LOG=info,tower_http=warn"
          ];
          EnvironmentFile = "${vars.secrets}/services/haproxy-ingest-server";
          Restart = "on-failure";
          RestartSec = "5s";

          CapabilityBoundingSet = [ "" ];
          DeviceAllow = [ "" ];
          LockPersonality = true;
          MemoryDenyWriteExecute = true;
          NoNewPrivileges = true;
          PrivateDevices = true;
          PrivateTmp = true;
          ProtectClock = true;
          ProtectControlGroups = true;
          ProtectHome = true;
          ProtectHostname = true;
          ProtectKernelLogs = true;
          ProtectKernelModules = true;
          ProtectKernelTunables = true;
          ProtectSystem = "strict";
          RemoveIPC = true;
          RestrictAddressFamilies = [
            "AF_INET"
            "AF_UNIX"
          ];
          RestrictNamespaces = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          SystemCallArchitectures = "native";
          SystemCallFilter = [
            "@system-service"
            "~@privileged"
          ];
          UMask = "0077";
        };
      };
    };
  };
}