{
  inputs',
  lib,
  config,
  pkgs,
  secret,
  ...
}: let
  inherit
    (lib)
    singleton
    mkForce
    ;
in {
  services.hashicorp.vault-agent = {
    settings.template = singleton {
      source =
        pkgs.writeText "consul.json.vtmpl"
        ''
          {
            "encrypt": "{{ with secret "kv/data/homelab-1/blowhole/consul/encryption_key" }}{{ or .Data.data.key "" }}{{ end }}",
            "acl": {
              "tokens": {
                "agent": "{{ with secret "kv/data/homelab-1/blowhole/consul/agent_token" }}{{ or .Data.data.secret "" }}{{ end }}",
                "default": "{{ with secret "kv/data/homelab-1/blowhole/consul/anonymous_token" }}{{ or .Data.data.secret "" }}{{ end }}"
              }
            }
          }
        '';
      destination = "/run/secrets/consul.json";
      command = pkgs.writeShellScript "consul-command" ''
        sudo systemctl try-reload-or-restart hashicorp-consul.service
      '';
    };
  };

  systemd.services."hashicorp-consul" = {
    requires = ["vault-unsealed.service"];
    after = ["vault-unsealed.service"];
  };

  services.hashicorp.consul = {
    enable = true;

    extraSettingsPaths = singleton "/run/secrets/consul.json";
    package = pkgs.consul;

    settings = {
      datacenter = "homelab-1";
      data_dir = "/var/lib/consul";
      log_level = "INFO";

      server = true;

      bind_addr = secret.network.ips.blowhole.ip or "";
      client_addr = secret.network.ips.blowhole.ip or "";

      primary_datacenter = "homelab-1";

      acl = {
        enabled = true;
        default_policy = "deny";
        enable_token_persistence = true;
      };

      ports = {
        http = 8500;
        grpc = 8502;
      };

      connect.enabled = true;

      ca_file = "/var/secrets/consul-ca.crt";
      # cert_file = ""
      # key_file = ""
      verify_incoming = false;
      verify_outgoing = false;
      verify_server_hostname = false;

      ui_config.enabled = true;
      domain = "consul.in.redalder.org";
    };
  };

  systemd.services.hashicorp-consul.serviceConfig = {
    LimitNOFILE = mkForce "infinity";
    LimitNPROC = mkForce "infinity";
  };
}