{
  config,
  globals,
  lib,
  ...
}: {
  options.atuin.enable = lib.mkEnableOption "atuin";

  config = lib.mkIf config.atuin.enable {
    kubernetes.resources = {
      secrets.database.stringData = {
        databasePassword = "ref+sops://secrets.yml#/atuin/databasePassword";
        databaseURL = "ref+sops://secrets.yml#/atuin/databaseURL";
      };

      deployments.server.spec = {
        selector.matchLabels.app = "atuin";

        strategy = {
          type = "RollingUpdate";

          rollingUpdate = {
            maxSurge = 0;
            maxUnavailable = 1;
          };
        };

        template = {
          metadata.labels.app = "atuin";

          spec = {
            volumes = {
              data.persistentVolumeClaim.claimName = "data";
              database.persistentVolumeClaim.claimName = "database";
            };

            containers = {
              atuin = {
                image = globals.images.atuin;
                imagePullPolicy = "IfNotPresent";
                ports.web.containerPort = 8888;
                args = ["server" "start"];

                env = {
                  ATUIN_HOST.value = "0.0.0.0";
                  ATUIN_PORT.value = "8888";
                  ATUIN_OPEN_REGISTRATION.value = "false";

                  ATUIN_DB_URI.valueFrom.secretKeyRef = {
                    name = "database";
                    key = "databaseURL";
                  };
                };

                volumeMounts = [
                  {
                    name = "data";
                    mountPath = "/config";
                  }
                ];
              };

              database = {
                image = globals.images.postgres14;
                ports.web.containerPort = 5432;

                env = {
                  POSTGRES_DB.value = "atuin";
                  POSTGRES_USER.value = "atuin";

                  POSTGRES_PASSWORD.valueFrom.secretKeyRef = {
                    name = "database";
                    key = "databasePassword";
                  };
                };

                volumeMounts = [
                  {
                    name = "database";
                    mountPath = "/var/lib/postgresql/data";
                  }
                ];
              };
            };
          };
        };
      };

      services.server.spec = {
        selector.app = "atuin";

        ports.web = {
          port = 80;
          targetPort = "web";
        };
      };
    };

    lab = {
      ingresses.server = {
        host = "atuin.kun.is";

        service = {
          name = "server";
          portName = "web";
        };
      };

      longhorn.persistentVolumeClaim = {
        data = {
          volumeName = "atuin";
          storage = "300Mi";
        };

        database = {
          volumeName = "atuin-db";
          storage = "300Mi";
        };
      };
    };
  };
}