{ config, ... }:
{
  services.vikunja = {
    enable = true;
    port = 8026;
    frontendScheme = "https";
    frontendHostname = "board.${config.domain}";
    settings = {
      service.enableregistration = false;
      # Webhook targets live on the tailnet (100.64.0.0/10), which Vikunja's
      # SSRF protection blocks by default ("prohibited IP address").
      outgoingrequests.allownonroutableips = true;
      auth = {
        local.enabled = false;
        openid = {
          enabled = true;
          redirecturl = "https://board.${config.domain}/auth/openid/";
          providers.dex = {
            name = "dex";
            authurl = "https://dex.${config.domain}/dex";
            clientid = "vikunja";
            clientsecret.file = "$CREDENTIALS_DIRECTORY/oidc-client-secret";
          };
        };
      };
    };
  };

  # Pass the OIDC secret through a private systemd credential file.
  systemd.services.vikunja.serviceConfig.LoadCredential =
    "oidc-client-secret:${config.age.secrets.oidcVikunja.path}";
}