{
  pkgs,
  config,
  ...
}: let
  fediPort = 8083;
  inherit ((pkgs.formats.elixirConf {}).lib) mkAtom;
in {
  age.secrets."hidden_service/akkoma".file = ../secrets/hidden_service/akkoma;

  services = {
    akkoma = {
      enable = true;
      config = {
        ":pleroma" = {
          ":instance" = {
            name = "social.distrust.network";
            description = "Akkoma instance for distrust.network users";
            email = "root@distrust.network";
            registration_open = false;
          };
          ":ldap" = {
            enabled = true;
            host = "localhost";
            port = 3890;
            ssl = false;
            tls = false;
            base = "ou=people,dc=distrust,dc=network";
            uid = "uid";
          };
          "Pleroma.Upload".base_url = "https://social.distrust.network/media/";
          "Pleroma.Web.Endpoint" = {
            url.host = "social.distrust.network";
            http = {
              ip = "0.0.0.0";
              port = fediPort;
            };
          };
          "Pleroma.Web.Auth.Authenticator" = mkAtom "Pleroma.Web.Auth.LDAPAuthenticator";
        };
      };
    };
    borgbackup.jobs."akkoma" = {
      repo = "ssh://u506783@u506783.your-storagebox.de:23/./akkoma";
      environment = {
        BORG_RSH = "ssh -i ${config.age.secrets."borg_ed25519".path} -o 'StrictHostKeyChecking=no'";
      };
      paths = [
        "/var/lib/akkoma"
        "/var/backup/postgres/akkoma.sql"
      ];
      encryption.mode = "none";
      compression = "auto,lzma";
      startAt = "daily";
      prune.keep = {
        daily = 7;
        weekly = 4;
        monthly = -1;
      };
      readWritePaths = [
        "/var/backup/postgres"
      ];
      preHook = ''
        mkdir -p /var/backup/postgres
        ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump akkoma > /var/backup/postgres/akkoma.sql
      '';
      postHook = ''
        rm -f /var/backup/postgres/akkoma.sql
      '';
    };
  };

  distrust.services."akkoma" = {
    url = "https://social.distrust.network";
    onion = {
      url = "http://n5j5sq55iem2hzbgvkba5vwd5gx5qj2pkb7nxyginbtmnkah74rtulad.onion";
      secretKey = config.age.secrets."hidden_service/akkoma".path;
    };
    virtualHostConfig = ''
      reverse_proxy localhost:${toString fediPort}
    '';
  };
}