{ ... }:
{
  _class = "clan.service";
  manifest.name = "grafana";
  manifest.description = "Platform for data analytics and monitoring";
  manifest.readme = "Platform for data analytics and monitoring";
  manifest.categories = [ "System" ];

  roles.default = {
    description = "A default server role";

    perInstance.nixosModule =
      {
        config,
        lib,
        pkgs,
        ...
      }:
      {
        clan.core.vars.generators.grafana = {
          files = {
            secret_key = {
              owner = "grafana";
              group = "grafana";
              secret = true;
            };
          };
          script = ''
            openssl rand -hex 32 > "$out"/secret_key
          '';
          runtimeInputs = [
            pkgs.openssl
          ];
        };
        services.grafana = {
          enable = lib.mkDefault true;
          settings.security.secret_key = "$__file{${config.clan.core.vars.generators.grafana.files.secret_key.path}}";
        };

        clan.core.state.grafana.folders = [ config.services.grafana.dataDir ];
      };
  };
}