{
  pkgs,
  lib,
  config,
  ...
}:
let
  enabled = config.mod.mullvad.enable;
in
{
  options = {
    mod.mullvad = {
      enable = lib.mkEnableOption "enable mullvad module";
    };
  };

  config = lib.mkIf enabled {
    services.mullvad-vpn = {
      enable = true;
      package = pkgs.mullvad-vpn;
    };

    age.secrets = {
      "mullvad-device" = {
        file = ../../../../secrets/pinwheel/mullvad-device.age;
        path = "/etc/mullvad-vpn/device.json";
      };

      "mullvad-account-history" = {
        file = ../../../../secrets/pinwheel/mullvad-account-history.age;
        path = "/etc/mullvad-vpn/account-history.json";
      };
    };
  };
}