{
  lib,
  pkgs,
  ...
}:
let
  vars = import ../vars.nix;

  vultrExporter = pkgs.buildGoModule rec {
    pname = "vultr-exporter";
    version = "0-unstable-2025-10-14";

    src = pkgs.fetchFromGitHub {
      owner = "DazWilkin";
      repo = "vultr-exporter";
      rev = "d8b5d7107c2eda31566e6e895c8a67db32fdaf68";
      hash = "sha256-3LpXh+mFMBRJfiY2ftELpM3AIE0LiZ9c6NFok0OeH5I=";
    };

    vendorHash = "sha256-qCHWmg6GxLIjqlf5UqRcuDRd1xqRFI3sl4ZduLajx+Y=";
    subPackages = [ "cmd/server" ];

    postPatch = ''
      substituteInPlace cmd/server/main.go \
        --replace-fail 'registry.MustRegister(collector.NewBlockStorageCollector(s, client, log))' "" \
        --replace-fail 'registry.MustRegister(collector.NewKubernetesCollector(s, client, log))' "" \
        --replace-fail 'registry.MustRegister(collector.NewLoadBalancerCollector(s, client, log))' "" \
        --replace-fail 'registry.MustRegister(collector.NewReservedIPsCollector(s, client, log))' ""
    '';

    ldflags = [
      "-s"
      "-w"
      "-X main.GitCommit=${src.rev}"
      "-X main.OSVersion=NixOS"
    ];

    postInstall = ''
      mv $out/bin/server $out/bin/vultr-exporter
    '';

    meta = {
      description = "Prometheus exporter for Vultr account, billing, and bandwidth metrics";
      homepage = "https://github.com/DazWilkin/vultr-exporter";
      license = lib.licenses.asl20;
      mainProgram = "vultr-exporter";
    };
  };
in
{
  systemd.services.vultr-exporter = {
    description = "Vultr Prometheus exporter";
    documentation = [ "https://github.com/DazWilkin/vultr-exporter" ];
    wants = [ "network-online.target" ];
    after = [ "network-online.target" ];
    wantedBy = [ "multi-user.target" ];

    serviceConfig = {
      ExecStart = "${lib.getExe vultrExporter} --endpoint=127.0.0.1:9188 --path=/metrics";
      EnvironmentFile = "${vars.secrets}/services/vultr-exporter";
      Restart = "on-failure";
      RestartSec = "30s";

      CapabilityBoundingSet = [ "" ];
      DeviceAllow = [ "" ];
      DynamicUser = true;
      LockPersonality = true;
      MemoryDenyWriteExecute = true;
      NoNewPrivileges = true;
      PrivateDevices = true;
      PrivateTmp = true;
      ProtectClock = true;
      ProtectControlGroups = true;
      ProtectHome = true;
      ProtectHostname = true;
      ProtectKernelLogs = true;
      ProtectKernelModules = true;
      ProtectKernelTunables = true;
      ProtectSystem = "strict";
      RemoveIPC = true;
      RestrictAddressFamilies = [
        "AF_INET"
        "AF_INET6"
      ];
      RestrictNamespaces = true;
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      SystemCallArchitectures = "native";
      SystemCallFilter = [
        "@system-service"
        "~@privileged"
      ];
      UMask = "0077";
    };
  };
}