{ lib, config, globals, ... }: {
  options.ntfy.enable = lib.mkEnableOption "ntfy";

  config = lib.mkIf config.ntfy.enable {
    kubernetes.resources = {
      configMaps.ntfy.data.config = lib.generators.toYAML { } {
        base-url = "https://ntfy.kun.is";
        cache-file = "/var/cache/ntfy/cache.db";
        cache-duration = "14d";
        auth-file = "/var/lib/ntfy/user.db";
        auth-default-access = "deny-all";
        attachment-cache-dir = "/var/cache/ntfy-attachments";
        enable-signup = false;
        enable-login = true;
        visitor-subscription-limit = 100;
      };

      deployments.ntfy.spec = {
        selector.matchLabels.app = "ntfy";

        strategy = {
          type = "RollingUpdate";

          rollingUpdate = {
            maxSurge = 0;
            maxUnavailable = 1;
          };
        };

        template = {
          metadata.labels.app = "ntfy";

          spec = {
            containers.ntfy = {
              image = globals.images.ntfy;
              ports.web.containerPort = 80;
              env.TZ.value = "Europe/Amsterdam";
              args = [ "serve" ];

              volumeMounts = [
                {
                  name = "cache";
                  mountPath = "/var/cache/ntfy";
                }
                {
                  name = "data";
                  mountPath = "/var/lib/ntfy";
                }
                {
                  name = "attachment-cache";
                  mountPath = "/var/cache/ntfy-attachments";
                }
                {
                  name = "config";
                  mountPath = "/etc/ntfy/server.yml";
                  subPath = "config";
                }
              ];
            };

            volumes = {
              cache.persistentVolumeClaim.claimName = "cache";
              attachment-cache.persistentVolumeClaim.claimName = "attachment-cache";
              data.persistentVolumeClaim.claimName = "data";
              config.configMap.name = "ntfy";
            };
          };
        };
      };

      persistentVolumeClaims = {
        cache.spec = {
          accessModes = [ "ReadWriteOnce" ];
          resources.requests.storage = "300Mi";
        };

        attachment-cache.spec = {
          accessModes = [ "ReadWriteOnce" ];
          resources.requests.storage = "500Mi";
        };
      };

      services.ntfy.spec = {
        selector.app = "ntfy";

        ports.web = {
          port = 80;
          targetPort = "web";
        };
      };
    };

    lab = {
      ingresses.ntfy = {
        host = "ntfy.kun.is";

        service = {
          name = "ntfy";
          portName = "web";
        };
      };

      longhorn.persistentVolumeClaim.data = {
        volumeName = "ntfy";
        storage = "300Mi";
      };
    };
  };
}