{
  options,
  config,
  lib,
  pkgs,
  ...
}: let
  inherit
    (lib)
    mkEnableOption
    mkOption
    literalExpression
    types
    mkDefault
    mkIf
    recursiveUpdate
    ;

  cfg = config.services.grafana-magic;
  settingsFile = settingsFormatIni.generate "config.ini" (recursiveUpdate cfg.settings {
    paths.provisioning = "/etc/grafana.d/provisioning";
  });

  provisioningSettingsFormat = pkgs.formats.yaml {};
  settingsFormatIni = pkgs.formats.ini {};
in {
  options.services.grafana-magic = {
    enable = mkEnableOption (lib.mdDoc "grafana");

    package = mkOption {
      description = lib.mdDoc "Package to use.";
      default = pkgs.grafana;
      defaultText = literalExpression "pkgs.grafana";
      type = types.package;
    };

    dataDir = mkOption {
      description = lib.mdDoc "Data directory.";
      default = "/var/lib/grafana";
      type = types.path;
    };

    settings = mkOption {
      description = lib.mdDoc ''
        Grafana settings. See <https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/>
        for available options. INI format is used.
      '';

      type = types.submodule {
        freeformType = settingsFormatIni.type;

        options = {
          paths.provisioning = mkOption {
            type = types.submodule {
              options = let
                provisioningOption = name: cname:
                  mkOption {
                    type = types.submodule {
                      options = {
                        apiVersion = mkOption {
                          type = types.int;
                          default = 1;
                        };

                        "delete${cname}" = mkOption {
                          type = provisioningSettingsFormat.type;
                          default = [];
                        };

                        "${name}" = mkOption {
                          type = provisioningSettingsFormat.type;
                          default = [];
                        };
                      };
                    };
                    default = {};
                  };
              in {
                datasources = provisioningOption "datasources" "Datasources";
                plugins = provisioningOption "plugins" "Plugins";
                dashboards = provisioningOption "dashboards" "Dashboards";
                notifiers = provisioningOption "notifiers" "Notifiers";
                alerting = provisioningOption "alerting" "Alerting";
              };
            };
            default = {};
            apply = x: let
              ln = name: ''
                mkdir -p $out/${name}
                ln -s ${provisioningSettingsFormat.generate "config.yaml" x.${name}} $out/${name}/config.yaml
              '';
            in
              pkgs.runCommand "grafana-provisioning" {} ''
                ${ln "datasources"}
                ${ln "notifiers"}
                ${ln "alerting"}
                ${ln "plugins"}
                ${ln "dashboards"}
              '';
          };
        };
      };

      default = {};
    };
  };

  config = mkIf cfg.enable {
    environment.systemPackages = [cfg.package];

    services.grafana-magic.settings = {
      server = {
        static_root_path = "${cfg.package}/share/grafana/public";
        http_port = mkDefault 3000;
        protocol = mkDefault "http";
      };
    };

    environment.etc."grafana.d/main.ini" = {
      source = settingsFile;
    };

    environment.etc."grafana.d/provisioning" = {
      source = cfg.settings.paths.provisioning;
    };

    systemd.services.grafana = {
      description = "Grafana Service Daemon";
      wantedBy = ["multi-user.target"];
      after = ["networking.target"];
      serviceConfig = {
        ExecStart = "${cfg.package}/bin/grafana-server -homepath ${cfg.dataDir} -config ${settingsFile}";
        WorkingDirectory = cfg.dataDir;
        User = "grafana";
        RuntimeDirectory = "grafana";
        RuntimeDirectoryMode = "0755";
        # Hardening
        AmbientCapabilities = lib.mkIf (cfg.settings.server.http_port < 1024) ["CAP_NET_BIND_SERVICE"];
        CapabilityBoundingSet =
          if (cfg.settings.server.http_port < 1024)
          then ["CAP_NET_BIND_SERVICE"]
          else [""];
        DeviceAllow = [""];
        LockPersonality = true;
        NoNewPrivileges = true;
        PrivateDevices = true;
        PrivateTmp = true;
        ProtectClock = true;
        ProtectControlGroups = true;
        ProtectHome = true;
        ProtectHostname = true;
        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
        ProtectProc = "invisible";
        ProtectSystem = "full";
        RemoveIPC = true;
        RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"];
        RestrictNamespaces = true;
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
        SystemCallArchitectures = "native";
        # Upstream grafana is not setting SystemCallFilter for compatibility
        # reasons, see https://github.com/grafana/grafana/pull/40176
        SystemCallFilter =
          [
            "@system-service"
            "~@privileged"
          ]
          ++ lib.optional (cfg.settings.server.protocol == "socket") ["@chown"];
        UMask = "0027";
      };
      preStart = ''
        ln -fs ${cfg.package}/share/grafana/conf ${cfg.dataDir}
        ln -fs ${cfg.package}/share/grafana/tools ${cfg.dataDir}
      '';
    };

    users.users.grafana = {
      uid = config.ids.uids.grafana;
      description = "Grafana user";
      home = cfg.dataDir;
      createHome = true;
      group = "grafana";
    };
    users.groups.grafana = {};
  };
}