{ config, pkgs, ... }:
{
  services.prosody = {
    enable = true;

    # The included agenix files only exist at runtime.
    checkConfig = false;

    package = pkgs.prosody.override {
      withExtraLuaPackages = luaPackages: [
        luaPackages.lualdap
      ];
      withOnlyInstalledCommunityModules = [
        "muc_moderation"
      ];
    };

    c2sRequireEncryption = true;
    s2sRequireEncryption = true;

    httpFileShare = {
      domain = "upload.${config.domain}";
      http_external_url = "https://upload.${config.domain}/";
    };

    httpPorts = [ 5280 ];
    httpsPorts = [ 5281 ];

    extraModules = [
      "http"
      "presence"
    ];

    extraConfig = ''
      proxy65_address = "${config.tailnetIPs.blunix}"
      trusted_proxies = {
        "${config.tailnetIPs.blunix}",
        "127.0.0.1",
        "::1",
      }
      prosodyctl_service_warnings = false
      Include "/run/agenix/${config.domain}.cfg.lua"
      Include "/run/agenix/motd.cfg.lua"
    '';

    virtualHosts."${config.domain}" = {
      enabled = true;
      domain = config.domain;
      extraConfig = ''
        authentication = "ldap";
        ldap_base = "ou=people,${config.ldapBaseDN}"
        ldap_server = "${config.tailnetIPs.blunix}:3890"
        ldap_rootdn = "uid=admin,ou=people,${config.ldapBaseDN}"
        filter = "(uid=$user)"
      '';
      ssl = {
        cert = "/var/lib/prosody/certs/${config.domain}.crt.pem";
        key = "/var/lib/prosody/certs/${config.domain}.key.pem";
      };
    };

    muc = [
      {
        domain = "muc.${config.domain}";
        name = "0ff.space public chatrooms";
        restrictRoomCreation = "local";
        moderation = true;
        roomDefaultLanguage = "de";
        roomDefaultPublic = false;
        roomDefaultMembersOnly = true;
        extraConfig = ''
          muc_room_default_persistent = true
          muc_log_by_default = true
          muc_log_expires_after = "30d"
          muc_log_cleanup_interval = 4 * 60 * 60
        '';
      }
    ];

    virtualHosts."bot.${config.domain}" = {
      enabled = true;
      domain = "bot.${config.domain}";
      extraConfig = ''
        modules_enabled = { "admin_shell"; }
        authentication = "internal_hashed";
      '';
      ssl = {
        cert = "/var/lib/prosody/certs/${config.domain}.crt.pem";
        key = "/var/lib/prosody/certs/${config.domain}.key.pem";
      };
    };
  };
}