{
  config,
  pkgs,
  ...
}: let
  influxdbPassword = config.sops.secrets."influxdb/password".path;
  influxdbToken = config.sops.secrets."influxdb/token".path;
in {
  sops.secrets."influxdb/password" = {
    sopsFile = ../../secrets/secrets.yaml;
    owner = "influxdb2";
  };
  sops.secrets."influxdb/token" = {
    sopsFile = ../../secrets/secrets.yaml;
    group = "influxdb2";
    mode = "0440";
  };

  networking.firewall.allowedTCPPorts = [8086];

  services.influxdb2 = {
    enable = true;
    settings = {
    };
    provision = {
      enable = true;
      initialSetup = {
        username = "plasmagoat";
        passwordFile = influxdbPassword;
        tokenFile = influxdbToken;
        organization = "procopius";
        bucket = "proxmox";
      };
    };
  };
}