{lib, ...}: {
  imports = [
    ./proxy.nix
    ./database.nix
    ./fail2ban.nix
    ./impermanence.nix
  ];

  options.services.immich = {
    subdomain = lib.mkOption {
      type = lib.types.str;
      description = "subdomain of base domain that immich will be hosted at";
      default = "immich";
    };
  };

  # NOTE: This shouldn't be needed now that we are out of testing
  # config = lib.mkIf config.services.immich.enable {
  #   networking.firewall.interfaces.${config.services.tailscale.interfaceName} = {
  #     allowedUDPPorts = [
  #       config.services.immich.port
  #     ];
  #     allowedTCPPorts = [
  #       config.services.immich.port
  #     ];
  #   };
  # };
}