{
  config,
  lib,
  masterDomain,
  ...
}:
let
  cfg = config.os.srv.authelia;
in
{
  options.os.srv.authelia = {
    enable = lib.mkEnableOption "enables authelia scanning";
    extraRules = lib.mkOption {
      type = lib.types.listOf lib.types.attrs;
      default = [ ];
      description = "Additional access control rules to be appended to Authelia.";
    };
  };
  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = config.os.srv.sops.enable;
        message = "Required for password secure password storing";
      }
      {
        assertion = config.os.srv.lldap.enable;
        message = "required for user accounts";
      }
    ];
    services.authelia.instances.main = {
      enable = true;
      secrets = {
        jwtSecretFile = config.sops.secrets."authelia/jwt_secret".path;
        storageEncryptionKeyFile = config.sops.secrets."authelia/encryptionKey".path;
      };
      settings = {
        theme = "dark";
        authentication_backend = {
          ldap = {
            address = "ldap://127.0.0.1:3890";
            implementation = "lldap";
            base_dn = "dc=example,dc=com";
            user = "uid=authelia,ou=people,dc=example,dc=com";
            password_file = config.sops.secrets."lldap/bind_password".path;
          };
        };
        access_control = {
          default_policy = "deny";
          rules = [
            {
              domain = "auth.${masterDomain}";
              policy = "bypass";
            }
          ]
          ++ cfg.extraRules;
        };
        session.domain = masterDomain;
      };
    };
  };
}