{ ... }:
{
  _class = "clan.service";
  manifest.name = "nextcloud";
  manifest.description = "Nextcloud server, a safe home for all your data";
  manifest.readme = "Nextcloud server, a safe home for all your data";
  manifest.categories = [ "System" ];

  roles.default = {
    description = "a default server role";

    perInstance.nixosModule =
      {
        config,
        pkgs,
        lib,
        ...
      }:
      {
        clan.core.vars.generators.nextcloud = {
          files = {
            adminpassFile = {
              owner = "nextcloud";
              group = "nextcloud";
              secret = true;
            };
          };
          script = ''
            xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassFile
          '';
          runtimeInputs = [
            pkgs.xkcdpass
          ];
        };

        services.nextcloud = {
          enable = lib.mkDefault true;
          hostName = lib.mkDefault "localhost";
          database.createLocally = lib.mkDefault true;
          config = {
            dbtype = lib.mkDefault "pgsql";
            dbhost = lib.mkDefault "/run/postgresql";
            dbuser = lib.mkDefault "nextcloud";
            dbname = lib.mkDefault "nextcloud";
          };
        };

        # nixpkgs installs Nextcloud with --disable-admin-user; create the
        # admin account ourselves once the instance is installed.
        systemd.services.nextcloud-admin-user = {
          wantedBy = [ "multi-user.target" ];
          after = [ "nextcloud-setup.service" ];
          requires = [ "nextcloud-setup.service" ];
          before = [ "phpfpm-nextcloud.service" ];
          path = [ config.services.nextcloud.occ ];
          serviceConfig = {
            Type = "oneshot";
            User = "nextcloud";
          };
          script = ''
            if ! nextcloud-occ user:info admin >/dev/null 2>&1; then
              NC_PASS="$(<${config.clan.core.vars.generators.nextcloud.files.adminpassFile.path})" \
                nextcloud-occ user:add admin --password-from-env --group admin
            fi
          '';
        };

        clan.core.state.nextcloud.folders = [
          config.services.nextcloud.home
        ]
        ++ (
          if config.services.nextcloud.home != config.services.nextcloud.datadir then
            [ config.services.nextcloud.datadir ]
          else
            [ ]
        );
      };
  };
}