{config, ...}: let
  lldapPort = 8089;
in {
  age.secrets."hidden_service/lldap".file = ../secrets/hidden_service/lldap;

  services = {
    lldap = {
      enable = true;
      settings = {
        http_url = "https://login.distrust.network";
        http_port = lldapPort;
        ldap_user_email = "root@distrust.network";
        ldap_user_dn = "root";
        ldap_base_dn = "dc=distrust,dc=network";
        ldap_user_pass = "VERY_SECURE";
      };
    };
    borgbackup.jobs."lldap" = {
      repo = "ssh://u506783@u506783.your-storagebox.de:23/./lldap";
      environment = {
        BORG_RSH = "ssh -i ${config.age.secrets."borg_ed25519".path} -o 'StrictHostKeyChecking=no'";
      };
      paths = [
        "/var/lib/lldap"
      ];
      encryption.mode = "none";
      compression = "auto,lzma";
      startAt = "daily";
      prune.keep = {
        daily = 7;
        weekly = 4;
        monthly = -1;
      };
    };
  };

  distrust.services."lldap" = {
    url = "https://login.distrust.network";
    onion = {
      url = "http://i3a47orggn2cebueja2jur66yjgyqd2y7kzthajar4ghuerbx2kzwqyd.onion";
      secretKey = config.age.secrets."hidden_service/lldap".path;
    };
    virtualHostConfig = ''
      reverse_proxy localhost:${toString lldapPort}
    '';
  };
}