{
  config,
  pkgs,
  lib,
  tflib,
  ...
}: let
  cfg = config.prefab.consulAgent;
  inherit
    (lib)
    mkOption
    types
    mapAttrsToList
    fix
    optionalString
    optionalAttrs
    singleton
    mkMerge
    flip
    ;
  inherit
    (tflib)
    tf
    ;

  submoduleOptions = {
    datacenter = mkOption {
      description = ''
      '';
      type = types.str;
    };

    replicationDatacenters = mkOption {
      description = ''
      '';
      type = with types; listOf str;
    };

    encryptionKey = mkOption {
      description = ''
        DO NOT hardcode the secret in Nix, generate it with Terraform
        and let Terraform substitute it.
      '';
      type = types.str;
    };

    anonymousToken = mkOption {
      description = ''
        DO NOT hardcode the secret in Nix, generate it with Terraform
        and let Terraform substitute it.
      '';
      type = types.submodule {
        options.secret = mkOption {
          description = '''';
          type = types.str;
        };

        options.accessor = mkOption {
          description = '''';
          type = types.str;
        };
      };
    };

    paths = {
      encryptionKey = mkOption {
        description = ''
        '';
        type = types.str;
      };
      agentToken = mkOption {
        description = ''
        '';
        type = types.str;
      };
      replicationToken = mkOption {
        description = ''
        '';
        type = with types; nullOr str;
        default = null;
      };
      anonymousToken = mkOption {
        description = ''
        '';
        type = types.str;
      };
    };

    vaultKvMount = mkOption {
      description = ''
      '';
      type = types.str;
    };
  };
in {
  options.prefab.consulAgent = mkOption {
    description = ''
    '';
    type = with types; attrsOf (submodule {options = submoduleOptions;});
    default = {};
  };

  config.resource =
    mkMerge
    (flip mapAttrsToList cfg (hostname: value:
        fix (self: {
          "consul_acl_policy"."${hostname}_agent" = {
            name = "${hostname}-consul-agent";
            rules = ''
              node "${hostname}" {
                policy = "write"
              }
              agent "${hostname}" {
                policy = "write"
              }
              service_prefix "" {
                policy = "write"
              }
            '';
          };

          "consul_acl_token"."${hostname}_consul_agent" = {
            description = "Consul agent token on ${hostname}";
            node_identities = singleton {
              node_name = hostname;
              datacenter = value.datacenter;
            };
            local = false;
          };

          "vault_kv_secret_v2"."${hostname}_consul_encryption_key" = {
            mount = value.vaultKvMount;
            name = value.paths.encryptionKey;
            delete_all_versions = true;
            data_json = builtins.toJSON {
              key = value.encryptionKey;
            };
          };

          "vault_kv_secret_v2"."${hostname}_consul_anonymous_token" = {
            mount = value.vaultKvMount;
            name = value.paths.anonymousToken;
            delete_all_versions = true;
            data_json = builtins.toJSON {
              secret = value.anonymousToken.secret;
              accessor = value.anonymousToken.accessor;
            };
          };

          "vault_kv_secret_v2"."${hostname}_consul_agent" = {
            mount = value.vaultKvMount;
            name = value.paths.agentToken;
            delete_all_versions = true;
            data_json = builtins.toJSON {
              secret = tf "data.consul_acl_token_secret_id.${hostname}_consul_agent.secret_id";
              accessor = tf "consul_acl_token.${hostname}_consul_agent.id";
            };
          };

          "vault_policy"."${hostname}_consul" = {
            name = "${hostname}_consul_agent";

            policy = ''
              path "${value.vaultKvMount}/data/${value.paths.encryptionKey}" {
                capabilities = ["read"]
              }

              path "${value.vaultKvMount}/data/${value.paths.agentToken}" {
                capabilities = ["read"]
              }

              ${optionalString (value.paths.replicationToken != null) ''
                path "${value.vaultKvMount}/data/${value.paths.replicationToken}" {
                  capabilities = ["read"]
                }
              ''}

              path "${value.vaultKvMount}/data/${value.paths.anonymousToken}" {
                capabilities = ["read"]
              }
            '';
          };
        }))
      ++ (flip mapAttrsToList cfg (
        hostname: value: (optionalAttrs (value.paths.replicationToken != null) {
          "consul_acl_policy"."${hostname}_replication" = {
            name = "${hostname}_consul_replication";
            datacenters = value.replicationDatacenters;
            rules = ''
              acl = "write"

              operator = "write"

              service_prefix "" {
                policy = "read"
                intentions = "read"
              }
            '';
          };

          "consul_acl_token"."${hostname}_consul_replication" = {
            description = "Consul replication token on ${hostname}";
            policies = [
              (tf "consul_acl_policy.${hostname}_replication.name")
            ];
            local = false;
          };

          "vault_kv_secret_v2"."${hostname}_consul_replication" = {
            mount = value.vaultKvMount;
            name = value.paths.replicationToken;
            delete_all_versions = true;
            data_json = builtins.toJSON {
              secret = tf "data.consul_acl_token_secret_id.${hostname}_consul_replication.secret_id";
              accessor = tf "consul_acl_token.${hostname}_consul_replication.id";
            };
          };
        })
      )));

  config.data =
    mkMerge
    (flip mapAttrsToList cfg (
        hostname: value: {
          "consul_acl_token_secret_id"."${hostname}_consul_agent" = {
            accessor_id = tf "consul_acl_token.${hostname}_consul_agent.id";
          };
        }
      )
      ++ flip mapAttrsToList cfg (
        hostname: value: (optionalAttrs (value.paths.replicationToken != null) {
          "consul_acl_token_secret_id"."${hostname}_consul_replication" = {
            accessor_id = tf "consul_acl_token.${hostname}_consul_replication.id";
          };
        })
      ));
}