{ config, lib, ... }:
let
  cfg = config.os.srv.lldap;
in
{
  options.os.srv.lldap.enable = lib.mkEnableOption "enables lldap scanning";
  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = config.os.srv.sops.enable;
        message = "Required for password secure password storing";
      }
    ];
    services.lldap = {
      enable = true;
      settings = {
        ldap_base_dn = "dc=example,dc=com";
        ldap_port = 3890;
        http_port = 17170;
      };
      environmentFile = config.sops.secrets."lldap/env".path;
    };
  };
}