{
  config,
  lib,
  pkgs,
  ...
}:
with lib; let
  service = "minio";
  cfg = config.homelab.services.${service};
  homelabCfg = config.homelab;
in {
  options.homelab.services.${service} = {
    enable = mkEnableOption "Minio Object Storage";

    port = mkOption {
      default = 9000;
      type = types.port;
      description = "Port of the server.";
    };

    webPort = mkOption {
      default = 9001;
      type = types.port;
      description = "Port of the web UI (console).";
    };

    openFirewall = mkOption {
      type = types.bool;
      default = true;
      description = ''
        Whether to open the ports specified in `port` and `webPort` in the firewall.
      '';
    };
  };

  config = mkIf cfg.enable {
    sops.secrets."ente/minio/root_user" = {};
    sops.secrets."ente/minio/root_password" = {};

    sops.templates."minio-root-credentials".content = ''
      MINIO_ROOT_USER=${config.sops.placeholder."ente/minio/root_user"}
      MINIO_ROOT_PASSWORD=${config.sops.placeholder."ente/minio/root_password"}
    '';

    services.minio = {
      enable = true;
      rootCredentialsFile = config.sops.templates."minio-root-credentials".path;
    };

    networking.firewall.allowedTCPPorts = optionals cfg.openFirewall [cfg.port cfg.webPort];

    homelab.reverseProxy.entries = [
      {
        subdomain = "${service}-api";
        port = cfg.port;
      }
      {
        subdomain = "${service}";
        port = cfg.webPort;
      }
    ];

    # https://min.io/docs/minio/linux/operations/monitoring/collect-minio-metrics-using-prometheus.html
    # metrics and monitoring...
  };
}
