{
  config,
  lib,
  pkgs,
  masterDomain,
  securityTemplates,
  ...
}:
let
  cfg = config.os.srv.monero;
in
{
  options.os.srv.monero = {
    wallet.enable = lib.mkEnableOption "enables the monero wallet";
    service = {
      enable = lib.mkEnableOption "enables hosting a monero node";
      proxyConfig = lib.mkOption {
        type = lib.types.attrs;
        default = { };
      };
    };
  };

  config = lib.mkMerge [
    (lib.mkIf cfg.wallet.enable {
      environment.systemPackages = [ pkgs.monero-cli ];
    })
    (lib.mkIf cfg.service.enable {
      assertions = [
        {
          assertion = config.os.srv.sops.enable;
          message = "Required for password secure password storing";
        }
      ];

      sops.secrets."monero/rpc-password" = {
        owner = "monero";
        restartUnits = [ "monero.service" ];
      };

      services.monero = {
        enable = true;
        prune = true;
        limits = {
          upload = 1250;
          download = 12500;
          threads = 8;
        };
        banlist = builtins.fetchurl {
          url = "https://gui.xmr.pm/files/block.txt";
          hash = "0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw";
        };
        rpc = {
          restricted = true;
          user = "admin";
          password = config.sops.secrets."monero/rpc-password".path;
        };
      };

      os.srv.monero.service.proxyConfig = {
        "xmr.${masterDomain}" = {
          enableACME = true;
          forceSSL = true;

          locations."/" = {
            proxyPass = "http://${config.os.core.network.ips.vm9-relays}:18081";
            extraConfig = ''
              proxy_read_timeout 600s;
              proxy_send_timeout 600s;
              client_max_body_size 50m;

              ${securityTemplates.restrictToInternal}
            '';
          };
        };
      };

      # Left open for P2P syncing
      networking.firewall.allowedTCPPorts = [ 18080 ];
    })
  ];
}