{
  config,
  lib,
  masterDomain,
  ...
}:
let
  cfg = config.os.srv.simplex;
  internalSmpPort = 5223;
  internalXftpPort = 5224;
in
{
  options.os.srv.simplex = {
    enable = lib.mkEnableOption "enables SimpleX SMP and XFTP containers via Podman";
    tor.enable = lib.mkEnableOption "enables Tor hidden services for SimpleX";
  };

  config = lib.mkIf cfg.enable (
    lib.mkMerge [
      {
        assertions = [
          {
            assertion = config.os.srv.oci.enable;
            message = "SimpleX requires os.srv.oci to be enabled to run containers.";
          }
          {
            assertion = config.os.srv.nginx.enable;
            message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying.";
          }
          {
            assertion = config.os.srv.sops.enable;
            message = "SimpleX requires sops for managing container passwords securely.";
          }
        ];

        sops.secrets."simplex/smp-env" = { };
        sops.secrets."simplex/xftp-env" = { };

        virtualisation.oci-containers.containers = {
          simplex-smp = {
            image = "simplexchat/smp-server:latest";
            ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ];

            environment = {
              ADDR = "smp.${masterDomain}";
              CONFIG_DIR = "/etc/opt/simplex";
            };

            environmentFiles = [ config.sops.secrets."simplex/smp-env".path ];

            volumes = [
              "/var/lib/simplex/smp/config:/etc/opt/simplex:rw"
              "/var/lib/simplex/smp/logs:/var/opt/simplex:rw"
              "/var/lib/simplex/certs:/certificates:ro"
            ];
          };

          simplex-xftp = {
            image = "simplexchat/xftp-server:latest";
            ports = [ "127.0.0.1:${toString internalXftpPort}:443" ];

            environment = {
              ADDR = "xftp.${masterDomain}";
              QUOTA = "10gb";
            };

            environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ];
            volumes = [
              "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw"
              "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw"
              "/var/lib/simplex/xftp/files:/srv/xftp:rw"
            ];
          };
        };

        systemd.tmpfiles.rules = [
          "d /var/lib/simplex/smp/config 0755 root root -"
          "d /var/lib/simplex/smp/logs 0755 root root -"
          "d /var/lib/simplex/rsa_certs 0755 root root -"

          "d /var/lib/simplex/xftp/config 0755 root root -"
          "d /var/lib/simplex/xftp/logs 0755 root root -"
          "d /var/lib/simplex/xftp/files 0755 root root -"
        ];

        networking.firewall.allowedTCPPorts = [
          5223
          5224
        ];
      }

      (lib.mkIf cfg.tor.enable {
        assertions = [
          {
            assertion = config.os.srv.tor.enable;
            message = "SimpleX Tor support requires os.srv.tor to be enabled.";
          }
        ];

        services.tor.relay.onionServices = {
          simplex-smp = {
            version = 3;
            map = [
              {
                port = 5223;
                target = {
                  addr = "127.0.0.1";
                  port = internalSmpPort;
                };
              }
            ];
          };
          simplex-xftp = {
            version = 3;
            map = [
              {
                port = 5224;
                target = {
                  addr = "127.0.0.1";
                  port = internalXftpPort;
                };
              }
            ];
          };
        };
      })
    ]
  );
}