{ pkgs, ... }:
{
  environment.systemPackages = [
    pkgs.signal-cli
  ];

  users = {
    groups.signal-cli = { };
    users.signal-cli = {
      isSystemUser = true;
      group = "signal-cli";
      home = "/var/lib/signal-cli";
    };
  };

  systemd.tmpfiles.rules = [
    "d /var/lib/signal-cli 0700 signal-cli signal-cli - -"
    "Z /var/lib/signal-cli - signal-cli signal-cli - -"
  ];

  systemd.services.signal-cli = {
    description = "Signal CLI JSON-RPC service";
    after = [ "network-online.target" ];
    wants = [ "network-online.target" ];
    wantedBy = [ "multi-user.target" ];
    unitConfig.RequiresMountsFor = [ "/var/lib/signal-cli" ];

    serviceConfig = {
      Type = "simple";
      User = "signal-cli";
      Group = "signal-cli";
      ExecStart = "${pkgs.signal-cli}/bin/signal-cli --data-dir /var/lib/signal-cli daemon --socket /run/signal-cli/socket";
      Restart = "on-failure";
      RestartSec = "5s";
      SuccessExitStatus = 143;
      RuntimeDirectory = "signal-cli";
      RuntimeDirectoryMode = "0750";
      UMask = "0007";
      NoNewPrivileges = true;
      PrivateTmp = true;
      ProtectHome = true;
      ProtectSystem = "strict";
      ReadWritePaths = [ "/var/lib/signal-cli" ];
    };
  };
}