{config, pkgs, lib, ...}: {
    sops.secrets.clicks_nextcloud_db_password = {
        mode = lib.mkForce "0440";
        group = lib.mkForce "nextcloud";
    };

    users.users.nextcloud = {
        isSystemUser = true;
        createHome = true;
        home = "/var/lib/nextcloud";
        group = config.users.groups.nextcloud.name;
        shell = pkgs.bashInteractive;
    };
    users.groups.nextcloud = {};


    services.nextcloud.enable = true;
    services.nextcloud.config.adminpassFile = config.sops.secrets.nextcloud_admin_password.path;
    services.nextcloud.hostName = "nextcloud.clicks.codes";
    services.nextcloud.package = pkgs.nextcloud27;
    services.nextcloud.poolSettings = {
        pm = "dynamic";
        "pm.max_children" = "32";
        "pm.max_requests" = "500";
        "pm.max_spare_servers" = "4";
        "pm.min_spare_servers" = "2";
        "pm.start_servers" = "2";
        "listen.owner" = config.users.users.nextcloud.name;
        "listen.group" = config.users.users.nextcloud.group;
    };

    services.nextcloud.config = {
        dbtype = "pgsql";
        dbport = config.services.postgresql.port;
        dbpassFile = config.sops.secrets.clicks_nextcloud_db_password.path;
        dbname = "nextcloud";
        dbhost = "localhost";
        extraTrustedDomains = [ "nextcloud.clicks.codes" "docs.clicks.codes" ];
    };

    services.nextcloud.extraOptions = {
        social_login_auto_redirect = true;
    };

    services.nextcloud.extraApps = {
        sociallogin = pkgs.fetchNextcloudApp {
            url = "https://github.com/zorn-v/nextcloud-social-login/releases/download/v5.5.3/release.tar.gz";
            sha256 = "sha256-96/wtK7t23fXVRcntDONjgb5bYtZuaNZzbvQCa5Gsj4=";
        };
        richdocumentscode = pkgs.fetchNextcloudApp {
            url = "redacted";
            sha256 = "sha256-XYtjBZCIQ6+PL3BNLSZfJTgLLpOyphzR5HOAwI7bWx0=";
        };
        richdocuments = pkgs.fetchNextcloudApp {
            url = "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.2.0/richdocuments-v8.2.0.tar.gz";
            sha256 = "sha256-PKw7FXSWvden2+6XjnUDOvbTF71slgeTF/ktS/l2+Dk=";
        };
    };

    sops.secrets.nextcloud_admin_password = {
        mode = "0600";
        owner = config.users.users.nextcloud.name;
        group = config.users.users.nextcloud.group;
        sopsFile = ../secrets/nextcloud.json;
        format = "json";
    };
}