{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.services.downloadwf;
in
{
  options.services.downloadwf = {
    enable = lib.mkEnableOption "the File Drop private file host";

    user = lib.mkOption {
      type = lib.types.str;
      description = "System user that runs the service.";
    };

    workingDir = lib.mkOption {
      type = lib.types.str;
      default = "/srv/download";
      description = "Directory containing the code (src/server.ts).";
    };

    storageDir = lib.mkOption {
      type = lib.types.str;
      default = "/srv/download/storage";
      description = "Where files and metadata are persisted.";
    };

    host = lib.mkOption {
      type = lib.types.str;
      default = "127.0.0.1";
      description = "Bind address. Use 0.0.0.0 to expose directly.";
    };

    port = lib.mkOption {
      type = lib.types.port;
      default = 3000;
      description = "Listen port.";
    };

    maxFileSize = lib.mkOption {
      type = lib.types.str;
      default = "10GB";
      description = "Maximum upload size (B/KB/MB/GB/TB).";
    };

    fileTtlMs = lib.mkOption {
      type = lib.types.ints.positive;
      default = 7 * 24 * 60 * 60 * 1000;
      description = "Milliseconds before an uploaded file expires and is deleted.";
    };

    trustProxy = lib.mkEnableOption "trust of X-Forwarded-* headers (behind a reverse proxy)";
  };

  config = lib.mkIf cfg.enable {
    systemd.tmpfiles.rules = [
      "d ${cfg.storageDir} 0755 ${cfg.user} ${cfg.user} -"
    ];

    systemd.services.downloadwf = {
      description = "File Drop private file host";
      wantedBy = [ "multi-user.target" ];
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];

      path = with pkgs; [ bun ];

      serviceConfig = {
        Type = "simple";
        User = cfg.user;
        Group = cfg.user;
        WorkingDirectory = cfg.workingDir;
        Environment = [
          "HOME=/home/${cfg.user}"
          "PORT=${toString cfg.port}"
          "HOST=${cfg.host}"
          "STORAGE_DIR=${cfg.storageDir}"
          "MAX_FILE_SIZE=${cfg.maxFileSize}"
          "FILE_TTL_MS=${toString cfg.fileTtlMs}"
        ] ++ lib.optionals cfg.trustProxy [ "TRUST_PROXY=1" ];

        # no runtime deps, so no `bun install` needed at startup
        ExecStart = "${pkgs.bun}/bin/bun src/server.ts";
        Restart = "on-failure";
        RestartSec = 3;
        TimeoutStopSec = 30;

        # hardening
        NoNewPrivileges = true;
        PrivateTmp = true;
        ProtectSystem = "full";
        ProtectHome = true;
        ReadWritePaths = [ cfg.storageDir ];
      };
    };
  };
}