{
  config,
  lib,
  pkgs,
  utils,
  ...
}:
with lib;
let
  cfg = config.services.amule;
  amuledConfigFile = builtins.toString (
    pkgs.writeTextFile {
      name = "amule.conf";
      text = lib.generators.toINI { } amuledMergedConfig;
    }
  );
  amuledMergedConfig = attrsets.recursiveUpdate amuledDefaultConfig cfg.config;
  amuledDefaultConfig = {
    eMule = {
      AppVersion = "GIT";
      Nick = "http://www.aMule.org";
      QueueSizePref = 50;
      MaxUpload = 0;
      MaxDownload = 0;
      SlotAllocation = 2;
      Port = 4662;
      UDPPort = 4672;
      UDPEnable = 1;
      Address = "";
      Autoconnect = 1;
      MaxSourcesPerFile = 300;
      MaxConnections = 500;
      MaxConnectionsPerFiveSeconds = 20;
      RemoveDeadServer = 1;
      DeadServerRetry = 3;
      ServerKeepAliveTimeout = 0;
      Reconnect = 1;
      Scoresystem = 1;
      Serverlist = 0;
      AddServerListFromServer = 0;
      AddServerListFromClient = 0;
      SafeServerConnect = 0;
      AutoConnectStaticOnly = 0;
      UPnPEnabled = 0;
      UPnPTCPPort = 50000;
      SmartIdCheck = 1;
      ConnectToKad = 1;
      ConnectToED2K = 1;
      TempDir = "${cfg.dataDir}/temp";
      IncomingDir = "${cfg.dataDir}/incoming";
      ICH = 1;
      AICHTrust = 0;
      CheckDiskspace = 1;
      MinFreeDiskSpace = 1;
      AddNewFilesPaused = 0;
      PreviewPrio = 0;
      ManualHighPrio = 0;
      StartNextFile = 0;
      StartNextFileSameCat = 0;
      StartNextFileAlpha = 0;
      FileBufferSizePref = 16;
      DAPPref = 1;
      UAPPref = 1;
      AllocateFullFile = 0;
      OSDirectory = cfg.dataDir;
      OnlineSignature = 0;
      OnlineSignatureUpdate = 5;
      EnableTrayIcon = 0;
      MinToTray = 0;
      Notifications = 0;
      ConfirmExit = 1;
      StartupMinimized = 0;
      "3DDepth" = 10;
      ToolTipDelay = 1;
      ShowOverhead = 0;
      ShowInfoOnCatTabs = 1;
      VerticalToolbar = 0;
      GeoIPEnabled = 1;
      ShowVersionOnTitle = 0;
      VideoPlayer = "";
      StatGraphsInterval = 3;
      statsInterval = 30;
      DownloadCapacity = 300;
      UploadCapacity = 100;
      StatsAverageMinutes = 5;
      VariousStatisticsMaxValue = 100;
      SeeShare = 2;
      FilterLanIPs = 1;
      ParanoidFiltering = 1;
      IPFilterAutoLoad = 1;
      IPFilterURL = "";
      FilterLevel = 127;
      IPFilterSystem = 0;
      FilterMessages = 1;
      FilterAllMessages = 0;
      MessagesFromFriendsOnly = 0;
      MessageFromValidSourcesOnly = 1;
      FilterWordMessages = 0;
      MessageFilter = "";
      ShowMessagesInLog = 1;
      FilterComments = 0;
      CommentFilter = "";
      ShareHiddenFiles = 0;
      AutoSortDownloads = 0;
      NewVersionCheck = 1;
      AdvancedSpamFilter = 1;
      MessageUseCaptchas = 1;
      Language = "";
      SplitterbarPosition = 75;
      YourHostname = "";
      DateTimeFormat = "%A, %x, %X";
      AllcatType = 0;
      ShowAllNotCats = 0;
      SmartIdState = 0;
      DropSlowSources = 0;
      KadNodesUrl = "http://upd.emule-security.org/nodes.dat";
      Ed2kServersUrl = "http://upd.emule-security.org/server.met";
      ShowRatesOnTitle = 0;
      GeoLiteCountryUpdateUrl = "http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz";
      StatsServerName = "Shorty's ED2K stats";
      StatsServerURL = "http://ed2k.shortypower.dyndns.org/?hash=";
      CreateSparseFiles = 1;
    };

    Browser = {
      OpenPageInTab = 1;
      CustomBrowserString = "";
    };

    Proxy = {
      ProxyEnableProxy = 0;
      ProxyType = 0;
      ProxyName = "";
      ProxyPort = 1080;
      ProxyEnablePassword = 0;
      ProxyUser = "";
      ProxyPassword = "";
    };

    ExternalConnect = {
      UseSrcSeeds = 0;
      AcceptExternalConnections = 1;
      ECAddress = "127.0.0.1";
      ECPort = 4712;
      ECPassword = null;
      UPnPECEnabled = 0;
      ShowProgressBar = 1;
      ShowPercent = 1;
      UseSecIdent = 1;
      IpFilterClients = 1;
      IpFilterServers = 1;
      TransmitOnlyUploadingClients = 0;
    };

    WebServer = {
      Enabled = if cfg.enableWeb then 1 else 0;
      Password = null;
      PasswordLow = "";
      Port = 4711;
      WebUPnPTCPPort = 50001;
      UPnPWebServerEnabled = 0;
      UseGzip = 1;
      UseLowRightsUser = 0;
      PageRefreshTime = 60;
      Template = "default";
      Path = "amuleweb";
    };

    GUI = {
      HideOnClose = 0;
    };

    Razor_Preferences = {
      FastED2KLinksHandler = 1;
    };

    SkinGUIOptions = {
      Skin = "";
    };

    Statistics = {
      MaxClientVersions = 0;
    };

    Obfuscation = {
      IsClientCryptLayerSupported = 1;
      IsCryptLayerRequested = 1;
      IsClientCryptLayerRequired = 0;
      CryptoPaddingLenght = 254;
      CryptoKadUDPKey = null;
    };

    PowerManagement = {
      PreventSleepWhileDownloading = 0;
    };

    UserEvents = { };

    "UserEvents/DownloadCompleted" = {
      CoreEnabled = 0;
      CoreCommand = "";
      GUIEnabled = 0;
      GUICommand = "";
    };

    "UserEvents/NewChatSession" = {
      CoreEnabled = 0;
      CoreCommand = "";
      GUIEnabled = 0;
      GUICommand = "";
    };

    "UserEvents/OutOfDiskSpace" = {
      CoreEnabled = 0;
      CoreCommand = "";
      GUIEnabled = 0;
      GUICommand = "";
    };

    "UserEvents/ErrorOnCompletion" = {
      CoreEnabled = 0;
      CoreCommand = "";
      GUIEnabled = 0;
      GUICommand = "";
    };

    HTTPDownload = {
      URL_1 = "https://shortypower.org/server.met";
      URL_2 = "http://upd.emule-security.org/server.met";
    };
  };
in

{
  options = {
    services.amule = {
      enable = mkOption {
        type = types.bool;
        default = false;
        description = ''
          Whether to run the AMule daemon.
        '';
      };

      enableWeb = mkOption {
        type = types.bool;
        default = false;
        description = ''
          Whether to run the AMule web interface.
        '';
      };

      config = mkOption {
        type = types.attrs;
        default = amuledDefaultConfig;
        description = ''
          The configuration for the AMule daemon. At a minimum, you need to
          provide: ExternalConnect.ECPassword, and Obfuscation.CryptoKadUDPKey.
        '';
      };

      dataDir = mkOption {
        type = types.str;
        default = "/var/lib/amule/";
        description = ''
          The directory holding the configuration, and by default incoming and
          temporary files.
        '';
      };

      user = mkOption {
        type = types.str;
        default = "amule";
        description = ''
          The user the AMule daemon should run as.
        '';
      };

      group = mkOption {
        type = types.str;
        default = "amule";
        description = ''
          The group the AMule daemon should run as.
        '';
      };

      package = mkPackageOption pkgs "amule-daemon" { };

    };
  };

  config = mkIf cfg.enable {
    assertions = [
      {
        assertion = amuledMergedConfig.ExternalConnect.ECPassword != null;
        message = ''
          <option>services.amule.config.ExternalConnect.ECPassword</option> needs to be set.
        '';
      }
      {
        assertion = amuledMergedConfig.Obfuscation.CryptoKadUDPKey != null;
        message = ''
          <option>services.amule.config.Obfuscation.CryptoKadUDPKey</option> needs to be set.
          You can generate a random unsigned 32bit integer using "od -An -N4 -tu4 < /dev/urandom | tr -d ' '"
        '';
      }
      {
        assertion = cfg.enableWeb -> amuledMergedConfig.WebServer.Password != null;
        message = ''
          <option>services.amule.config.WebServer.Password</option> needs to be set if the web interface is enabled.
        '';
      }
    ];

    systemd.tmpfiles.settings."10-amuled".${cfg.dataDir}.d = {
      inherit (cfg) user group;
      mode = "0700";
    };

    users.users = mkIf (cfg.user == "amule") {
      amule = {
        inherit (cfg) group;
        home = cfg.dataDir;
        isNormalUser = false;
        isSystemUser = true;
        uid = config.ids.uids.amule;
      };
    };

    users.groups = mkIf (cfg.group == "amule") {
      amule = {
        gid = config.ids.gids.amule;
      };
    };

    systemd.services.amuled = {
      description = "AMule daemon";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      environment.HOME = cfg.dataDir;
      restartTriggers = [ amuledConfigFile ];

      # aMule requires write permissions to the config. A link to the store,
      # bind mount or the likes causes a crash, and if it's possible aMule
      # recreating the config as a normal file.
      preStart = ''
        rm -f ${cfg.dataDir}/amule.conf
        cat ${amuledConfigFile} > ${cfg.dataDir}/amule.conf
      '';

      serviceConfig = {
        User = "${cfg.user}";
        Group = "${cfg.group}";
        WorkingDirectory = cfg.dataDir;
        ExecStart = utils.escapeSystemdExecArgs (
          [
            (lib.getExe' cfg.package "amuled")
            "--config-dir=${config.services.amule.dataDir}"
          ]
          ++ optionals cfg.enableWeb [ "--use-amuleweb=${pkgs.amule-web}/bin/amuleweb" ]
        );

        # TODO: this failed
        Restart = "on-failure";
        RestartSec = "5s";

        # Hardening
        NoNewPrivileges = true;
        PrivateTmp = true;
        PrivateDevices = true;
        DevicePolicy = "closed";
        ProtectSystem = "strict";
        ReadWritePaths = cfg.dataDir;
        ProtectHome = "tmpfs";
        ProtectControlGroups = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
        RestrictAddressFamilies = "AF_INET";
        RestrictNamespaces = true;
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
        LockPersonality = true;
      };
    };
  };
}