{ config, ... }:
{
  services.lldap = {
    enable = true;
    settings = {
      http_host = "0.0.0.0";
      http_port = 17170;
      ldap_base_dn = config.ldapBaseDN;
      ldap_host = "0.0.0.0";
      ldap_port = 3890;
      ldap_user_dn = "admin";
      ldap_user_mail = config.adminEmail;
      ldap_user_pass_file = "/run/credentials/lldap.service/ldap-user-pass";
      force_ldap_user_pass_reset = "always";
    };
  };

  # systemd exposes the root-owned age secret only inside the LLDAP service.
  systemd.services.lldap.serviceConfig.LoadCredential =
    "ldap-user-pass:${config.age.secrets.lldapAdmin.path}";
}