{
  config,
  lib,
  masterDomain,
  securityTemplates,
  ...
}:
let
  cfg = config.os.srv.grafana;
in
{
  options.os.srv.grafana = {
    enable = lib.mkEnableOption "enables grafana";
    proxyConfig = lib.mkOption {
      type = lib.types.attrs;
      default = { };
    };
  };
  config = lib.mkIf cfg.enable {
    services.grafana = {
      enable = true;
      openFirewall = true;

      # Might use later
      # declarativePlugins = [ ];

      settings = {
        server = {
          protocol = "http";
          http_port = 3000;
          http_addr = "0.0.0.0";
          domain = "grafana.${masterDomain}";
          root_url = "https://grafana.${masterDomain}";
          enforceDomain = true;
          enable_gzip = true;
        };
        database = {
          wal = true;
        };
        security = {
          admin_user = "opc";
          # TODO: Generate password to use in sops-nix
          # admin_password = "sops"
          admin_email = "adikro@disroot.org";
          # TODO generate secret key and put it in sops-nix
          # secret_key = "sops";
          disable_gravatar = true;
          cookie_secure = true;
          cookie_samesite = "lax";
          # security
          allow_embedding = false;
          strict_transport_security = true;

          disable_initial_admin_creation = false;
          disable_brute_force_login_protection = false;
        };
        # TODO setup mailing
        # smtp = { enabled = true; };
        analytics.feedback_links_enabled = false;
      };
      provision = {
        enable = true;
        datasources.settings = {
          prune = true;

          datasources = [
            {
              name = "Prometheus";
              type = "prometheus";
              url = "http://127.0.0.1:9090";
              access = "proxy";
              isDefault = true;
              editable = false;
            }
            {
              name = "Loki";
              type = "loki";
              url = "http://127.0.0.1:3100";
              access = "proxy";
              editable = false;
            }
          ];
        };
      };
      # dashboards.settings = {
      #   providers = [
      #     {
      #       name = "default";
      #       type = "file";
      #       options.path = "/var/lib/grafana/dashboards";
      #     }
      #   ];
      # };
    };

    os.srv.grafana.proxyConfig = {
      "grafana.${masterDomain}" = {
        enableACME = true;
        forceSSL = true;

        locations."/" = {
          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
          proxyWebsockets = true;
          extraConfig = securityTemplates.restrictToInternal;
        };
      };
    };
  };
}