{
  config,
  lib,
  pkgs,
  ...
}:
{
  users.groups.authentik = { };
  users.users.authentik = {
    isSystemUser = true;
    extraGroups = [ "docker" ];
    group = "authentik";
  };
  services.authentik-ldap = {
    enable = true;
  };
  services.authentik = {
    enable = true;
    # The environmentFile needs to be on the target host!
    # Best use something like sops-nix or agenix to manage it
    environmentFile = "/var/lib/authentik_secret";
    settings = {
      email = {
        host = "mail.${config.networking.domain}";
        port = 25;
        username = "authentik@${config.networking.domain}";
        use_tls = false;
        use_ssl = false;
        from = "authentik@${config.networking.domain}";
      };
      disable_startup_analytics = true;
      avatars = "initials";
    };

    nginx = {
      enable = true;
      enableACME = true;
      host = "auth.${config.networking.domain}";
    };
  };
}