{ pkgs, ... }:
let
  haproxy_log_shipper = pkgs.callPackage ../../../rust/haproxy_log_shipper/package.nix { };
  endpoint = "http://jeeves.taile39c31.ts.net:8444";
  environment_file = "/var/lib/haproxy-log-shipper/environment";
in
{
  services.journald.settings.Journal = {
    Storage = "persistent";
    SystemMaxUse = "512M";
    MaxRetentionSec = "14day";
  };

  users = {
    groups.haproxy-log-shipper = { };
    users.haproxy-log-shipper = {
      isSystemUser = true;
      group = "haproxy-log-shipper";
      extraGroups = [ "systemd-journal" ];
    };
  };

  systemd = {
    services = {
      haproxy = {
        serviceConfig = {
          StandardOutput = "journal";
          StandardError = "journal";
        };
      };

      haproxy-log-shipper = {
        description = "Ship ordered HAProxy journal logs to Jeeves";
        documentation = [ "file://${../../../rust/haproxy_ingest_proto/README.md}" ];
        after = [
          "network-online.target"
          "tailscaled-autoconnect.service"
        ];
        wants = [
          "network-online.target"
          "tailscaled-autoconnect.service"
        ];

        serviceConfig = {
          Type = "oneshot";
          User = "haproxy-log-shipper";
          Group = "haproxy-log-shipper";
          SupplementaryGroups = [ "systemd-journal" ];
          ExecStart = "${haproxy_log_shipper}/bin/haproxy-log-shipper";
          Environment = [
            "HAPROXY_INGEST_ENDPOINT=${endpoint}"
            "RUST_LOG=info"
          ];
          EnvironmentFile = environment_file;

          CapabilityBoundingSet = [ "" ];
          DeviceAllow = [ "" ];
          LockPersonality = true;
          MemoryDenyWriteExecute = true;
          NoNewPrivileges = true;
          PrivateDevices = true;
          PrivateTmp = true;
          ProtectClock = true;
          ProtectControlGroups = true;
          ProtectHome = true;
          ProtectHostname = true;
          ProtectKernelLogs = true;
          ProtectKernelModules = true;
          ProtectKernelTunables = true;
          ProtectSystem = "strict";
          RemoveIPC = true;
          RestrictAddressFamilies = [
            "AF_INET"
            "AF_UNIX"
          ];
          RestrictNamespaces = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          SystemCallArchitectures = "native";
          SystemCallFilter = [
            "@system-service"
            "~@privileged"
          ];
          UMask = "0077";
        };
      };
    };

    timers.haproxy-log-shipper = {
      description = "Run the HAProxy log shipper after each completed catch-up cycle";
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnBootSec = "30s";
        OnUnitInactiveSec = "60s";
        Unit = "haproxy-log-shipper.service";
      };
    };

    tmpfiles.rules = [
      "d /var/lib/haproxy-log-shipper 0755 root root - -"
    ];
  };
}