{
  inputs,
  lib,
  config,
  ...
}:
let
  enabled = config.mod.schema.enable;
  nginxEnabled = config.mod.nginx.enable;
  port = 8092;
in
{
  options = {
    mod.schema = {
      enable = lib.mkEnableOption "Enable schema module";
    };
  };

  imports = [
    inputs.schema.nixosModules.default
  ];

  config = lib.mkIf enabled {
    mod.homepage.services = [
      {
        name = "Schema";
        port = port;
        description = "Our week: chores, meals, dog";
        # Login needs HTTPS (Secure cookies), so link to the public vhost.
        url = "https://schema.ppp.pm";
      }
    ];

    services.schema = {
      enable = true;
      address = "127.0.0.1";
      inherit port;
      # Served publicly over HTTPS via the nginx vhost below.
      secureCookies = true;
      inviteCodeFile = config.age.secrets."schema-invite-code".path;
      timeZone = "Europe/Stockholm";

      # Walks and meals logged in puppy-tracker tick off dog duties here. Needs
      # the integration endpoint from puppy-tracker (see below) to be deployed.
      # puppyTracker = {
      #   url = "http://127.0.0.1:8089";
      #   tokenFile = config.age.secrets."schema-puppy-token".path;
      # };
    };

    # The other half of the puppy-tracker link, enabled together with the
    # block above once puppy-tracker with integration.tokenFile is pushed.
    # services.puppy-tracker.integration.tokenFile = config.age.secrets."schema-puppy-token".path;
    # age.secrets."schema-puppy-token".file = ../../../../secrets/manatee/schema-puppy-token.age;

    services.nginx = lib.mkIf nginxEnabled {
      virtualHosts."schema.ppp.pm" = {
        forceSSL = true;
        useACMEHost = "schema.ppp.pm";

        locations."/" = {
          proxyPass = "http://127.0.0.1:${toString port}";
        };
      };
    };

    age.secrets."schema-invite-code".file = ../../../../secrets/manatee/schema-invite-code.age;
  };
}