{ config, pkgs, lib, ... }:
{
  # auto domain update

  systemd.services.domeneshop-updater = {
    description = "domene.shop domain updater";
    after = [ "network-online.target" ]; # TODO: multi-user ?
    wants = [ "network-online.target" ]; # TODO: multi-user ?
    serviceConfig = let
      prog = pkgs.writeShellApplication {
        name = "domeneshop-dyndns-updater.sh";
        runtimeInputs = with pkgs; [ curl yq ];
        text = ''
          test -s /var/lib/secrets/domeneshop.toml || {
            >&2 echo "ERROR: /var/lib/secrets/domeneshop.toml not found!"
            exit 1
          }
          DOMENESHOP_TOKEN="$( tomlq </var/lib/secrets/domeneshop.toml .secrets.DOMENESHOP_TOKEN  --raw-output)"
          DOMENESHOP_SECRET="$(tomlq </var/lib/secrets/domeneshop.toml .secrets.DOMENESHOP_SECRET --raw-output)"
          curl https://"$DOMENESHOP_TOKEN":"$DOMENESHOP_SECRET"@api.domeneshop.no/v0/dyndns/update?hostname=olavtr.pbsds.net
        '';
      };
    in {
      User  = "domeneshop";
      Group = "domeneshop";
      DynamicUser = true;
      ExecStart = "${prog}/bin/domeneshop-dyndns-updater.sh";
      PrivateTmp = true;
    };
  };
  systemd.timers.domeneshop-updater = let interval = "5h"; in {
    description = "Update domene.shop every ${interval}";
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnBootSec = "5m";
      OnUnitInactiveSec = interval;
      Unit = "domeneshop-updater.service";
    };
  };
}