{
  config,
  lib,
  pkgs,
  masterDomain,
  ...
}:
let
  cfg = config.os.srv.monero;
in
{
  options.os.srv.monero = {
    wallet.enable = lib.mkEnableOption "enables the monero wallet";
    service.enable = lib.mkEnableOption "enables hosting a monero node";
  };

  config = lib.mkMerge [
    (lib.mkIf cfg.wallet.enable {
      environment.systemPackages = [ pkgs.monero-cli ];
    })
    (lib.mkIf cfg.service.enable {
      assertions = [
        {
          assertion = config.os.srv.nginx.enable;
          message = "Hosting a Monero node requires nginx for proxying";
        }
        {
          assertion = config.os.srv.sops.enable;
          message = "Required for password secure password storing";
        }
      ];

      sops.secrets."monero/rpc-password" = {
        owner = "monero";
        restartUnits = [ "monero.service" ];
      };

      services.monero = {
        enable = true;
        environmentFile = config.sops.secrets."monero/rpc-password".path;
        banlist = builtins.fetchurl {
          url = "https://gui.xmr.pm/files/block.txt";
          hash = "0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw";
        };
        limits = {
          upload = 1250;
          download = 1250;
          threads = 4;
        };
        rpc = {
          restricted = true;
          user = "admin";
        };
      };

      services.nginx.virtualHosts."xmr.${masterDomain}" = {
        enableACME = true;
        forceSSL = true;

        locations."/" = {
          proxyPass = "http://127.0.0.1:18081";
          extraConfig = ''
            proxy_read_timeout 600s;
            proxy_send_timeout 600s;

            client_max_body_size 50m;
          '';
        };
      };

      # Left open for P2P syncing
      networking.firewall.allowedTCPPorts = [ 18080 ];
    })
  ];
}