{
  config,
  lib,
  pkgs,
  ...
}:
with lib; let
  serviceName = "alertmanager";
  cfg = config.homelab.services.${serviceName};
  homelabCfg = config.homelab;
in {
  imports = [
    (import ../lib/features/monitoring.nix serviceName)
    (import ../lib/features/logging.nix serviceName)
    (import ../lib/features/proxy.nix serviceName)
  ];

  # Core service options
  options.homelab.services.${serviceName} = {
    enable = mkEnableOption "Vault Warden";

    description = mkOption {
      type = types.str;
      default = "Vault Warden";
    };

    port = mkOption {
      type = types.port;
      default = 9093;
    };

    openFirewall = mkOption {
      type = types.bool;
      default = true;
      description = ''
        Whether to open the ports specified in `port` and `webPort` in the firewall.
      '';
    };

    environmentFile = lib.mkOption {
      type = with lib.types; nullOr path;
      default = null;
      example = "/var/lib/vaultwarden.env";
      description = ''
        Additional environment file as defined in {manpage}`systemd.exec(5)`.

        Secrets like {env}`ADMIN_TOKEN` and {env}`SMTP_PASSWORD`
        should be passed to the service without adding them to the world-readable Nix store.

        Note that this file needs to be available on the host on which `vaultwarden` is running.

        As a concrete example, to make the Admin UI available (from which new users can be invited initially),
        the secret {env}`ADMIN_TOKEN` needs to be defined as described
        [here](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page):

        ```
        # Admin secret token, see
        # https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page
        ADMIN_TOKEN=...copy-paste a unique generated secret token here...
        ```
      '';
    };

    systemdServices = mkOption {
      type = types.listOf types.str;
      default = [
        "vaultwarden.service"
        "vaultwarden"
      ];
      description = "Systemd services to monitor";
    };
  };

  # Service configuration with smart defaults
  config = mkIf cfg.enable (mkMerge [
    {
      services.prometheus.alertmanager = {
        enable = true;
        openFirewall = cfg.openFirewall;

        environmentFile = alertmanagerEnv;

        webExternalUrl = "http://monitor.lab:9093"; # optional but helpful
        configuration = {
          route = {
            receiver = "null";
            group_by = ["alertname"];
            group_wait = "10s";
            group_interval = "5m";
            repeat_interval = "4h";

            routes = [
              {
                receiver = "telegram";
                matchers = [
                  "severity =~ \"warning|critical\""
                ];
                group_wait = "10s";
                continue = true;
              }
            ];
          };

          receivers = [
            {name = "null";}
            {
              name = "telegram";
              telegram_configs = [
                {
                  api_url = "https://api.telegram.org";
                  bot_token = "$TELEGRAM_BOT_TOKEN";
                  chat_id = -1002642560007;
                  message_thread_id = 4;
                  parse_mode = "HTML";
                  send_resolved = true;
                  message = "{{ template \"telegram.message\". }}";
                }
              ];
            }
          ];

          templates = [
            (pkgs.writeText "telegram.tmpl" (builtins.readFile ./provisioning/templates/telegram.tmpl))
            # (pkgs.writeText "telegram.markdown.v2.tmpl" (builtins.readFile ./provisioning/templates/telegram.markdown.v2.tmpl))
          ];
        };
      };

      networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [cfg.port];
    }
    {
      homelab.services.${serviceName}.monitoring = {
        metrics.path = "/metrics";

        healthCheck.path = "/healthz";
        healthCheck.conditions = ["[STATUS] == 200" "[RESPONSE_TIME] < 1000"];

        extraLabels = {
          component = "example";
        };
      };
    }
    {
      # homelab.services.${serviceName}.logging = {
      #   files = ["/var/log/example/log.log"];
      #   # parsing = {
      #   #   regex = "^ts=(?P<timestamp>[^ ]+) caller=(?P<caller>[^ ]+) level=(?P<level>\\w+) msg=\"(?P<message>[^\"]*)\"";
      #   #   extractFields = ["level" "caller"];
      #   # };
      #   extraLabels = {
      #     component = "example";
      #     application = "example";
      #   };
      # };
    }
    {
      homelab.services.${serviceName}.proxy = {
        enableAuth = true;
      };
    }
  ]);
}
