{ config, lib, pkgs, ... }:

{
  
  users.users.nebula = {
    isSystemUser = true;
    group = "podman";
    home = "/var/lib/nebula";
    linger = false;
    createHome = true;
    autoSubUidGidRange = true;
  };
  
  sops = {
    secrets = {
      nebula-sync-env = {
        sopsFile = ../secrets/nebula-sync.env;
        format = "dotenv";
        owner = config.users.users.nebula.name;
      };
    };
  };
  

  virtualisation.oci-containers.containers.nebula-sync = {
    autoRemoveOnStop = false;
    autoStart = false;
    image = "ghcr.io/lovelaze/nebula-sync:0.11.2";
    environment = {
      FULL_SYNC = "false";
      RUN_GRAVITY = "true";
      CRON = "23 * * * *";
      CLIENT_SKIP_TLS_VERIFICATION = "true";
    };
    environmentFiles = [ config.sops.secrets.nebula-sync-env.path ];
    podman = { user = "nebula"; };
    log-driver = "journald";
  };

}