{ config, lib, pkgs, ... }: {
  users.groups.authentik = { };
  users.users.authentik = {
    isSystemUser = true;
    extraGroups = [ "docker" ];
    group = "authentik";
  };
  services.authentik = {
    enable = true;
    # The environmentFile needs to be on the target host!
    # Best use something like sops-nix or agenix to manage it
    environmentFile = "/var/lib/authentik_secret";
    settings = {
      email = {
        host = "mail.stura.htw-dresden.de";
        port = 25;
        username = "authentik@stura.htw-dresden.de";
        use_tls = false;
        use_ssl = false;
        from = "authentik@stura.htw-dresden.de";
      };
      disable_startup_analytics = true;
      avatars = "initials";
    };

    nginx = {
      enable = true;
      enableACME = true;
      host = "auth.htw.stura-dresden.de";
    };
  };
}