{
  pkgs,
  config,
  lib,
  inputs,
  ...
}: let
  service = "srcds";
  cfg = config.gameservers.${service};
in {
  imports = [inputs.srcds-nix.nixosModules.default];

  options.gameservers.${service} = {
    enable = lib.mkEnableOption "Counter Strike 2 server";
    data_dir = lib.mkOption {
      type = lib.types.str;
      default = "/var/lib/gameservers/cs2";
    };
    port = lib.mkOption {
      type = lib.types.int;
      default = 27015;
    };
    tv_port = lib.mkOption {
      type = lib.types.int;
      default = 27016;
    };
    hostname = lib.mkOption {
      type = lib.types.str;
      default = "recoil.pro CS2";
    };
    map = lib.mkOption {
      type = lib.types.str;
      default = "de_dust2";
    };
    max_players = lib.mkOption {
      type = lib.types.int;
      default = 10;
    };
    backup = lib.mkOption {
      type = lib.types.bool;
      default = true;
    };
    backup_repo = lib.mkOption {
      type = lib.types.path;
      default = "/holocron/archives/gameservers/cs2";
    };
  };

  config = lib.mkIf cfg.enable {
    users.users.cs2 = {
      isSystemUser = true;
      group = "cs2";
      home = cfg.data_dir;
      createHome = true;
    };

    users.groups.cs2 = {};

    services.srcds = {
      enable = true;
      openFirewall = true;
      games = {
        cs2-server = {
          appId = 730;
          gamePort = cfg.port;
          rcon = {
            enable = true;
            password = "secretpass";
          };
          extraArgs = [];
          startingMap = cfg.map;
        };
      };
    };

    environment.systemPackages = with pkgs; [
      rcon
    ];

    # backups cs2 server with borg!
    services.borgbackup.jobs.${service} = {
      archiveBaseName = service;
      repo = cfg.backup_repo;
      paths = cfg.data_dir;
      compression = "auto,zstd";
      #preHook = "systemctl start mysql-backup.service";
      startAt = "*-*-* *:00:00";
      group = "archives";
      encryption.mode = "repokey-blake2";
      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
      prune.keep = {
        within = "1d"; # Keep all archives from the last day
        hourly = 24;
        daily = 7;
        weekly = 12;
        monthly = -1; # Keep at least one archive for each month
      };
    };

    # manage secrets with sops
    sops.secrets = {
      "${service}/gslt" = {
        owner = service;
        group = service;
      };
      "${service}/rcon" = {
        owner = service;
        group = service;
      };
    };
  };
}