{ config, lib, pkgs, ... }:
let
  cfg = config.services.kubo;
  ipfsApi = pkgs.writeTextDir "api" "/ip4/127.0.0.1/tcp/5001";
in {
  services.kubo = {
    enable = true;
    swarmAddress = [
      "/ip4/0.0.0.0/tcp/4001"
      "/ip4/0.0.0.0/tcp/110"
    ];
    localDiscovery = true;
    autoMount = true;
    startWhenNeeded = false;
    enableGC = true;
    extraFlags = [ "--enable-pubsub-experiment" "--enable-namesys-pubsub" ];
    extraConfig = {
      Bootstrap = [
        "/ip4/95.216.8.12/tcp/110/p2p/Qmd7QHZU8UjfYdwmjmq1SBh9pvER9AwHpfwQvnvNo3HBBo"
        "/ip4/51.38.87.150/tcp/4001/p2p/12D3KooWDUgNsoLVauCDpRAo54mc4whoBudgeXQnZZK2iVYhBLCN"
      ];
    };
  };

  systemd.services.ipfs = {
    environment.LIBP2P_FORCE_PNET = "1";
    serviceConfig = {
      AmbientCapabilities = "CAP_NET_BIND_SERVICE";
      ReadWritePaths = lib.mkForce [ ];
    };
  };
  systemd.sockets = {
    ipfs-api.enable = false;
    ipfs-gateway.enable = false;
  };

  environment = {
    variables.IPFS_PATH = lib.mkForce "${ipfsApi}";
    shellAliases = {
      ipfs-admin = "doas -u ${cfg.user} env IPFS_PATH=${cfg.dataDir} ipfs";
      f = "ipfs files";
    };
  };

  networking.firewall.allowedTCPPorts = [ 110 4001 ];

  environment.systemPackages = lib.singleton (pkgs.writeShellScriptBin "share" ''
      PATH=${cfg.package}/bin:$PATH
      set -e
      cid=$(ipfs add -Qrp --pin=false "$@")
      test -n $cid || exit 0
      echo -e "\n\n IPFS path: /ipfs/$cid"
      echo -e " Web link: https://$(ipfs cid base32 $cid).ipfs.privatevoid.net\n"
    '');
  networking.networkmanager.dispatcherScripts = [{
    source = pkgs.writeShellScript "nm-ipfs-reconnect.sh" ''
      [[ "$2" != "up" ]] && exit 0
      PATH=${pkgs.systemd}/bin:${pkgs.findutils}/bin:${cfg.package}/bin:$PATH
      export IPFS_PATH=${ipfsApi}
      systemctl is-active ipfs.service || exit 0
      case $1 in
              wl*|en*)
                ipfs swarm peers | xargs -P4 -n1 timeout 3 ipfs swarm disconnect
                ipfs bootstrap | xargs -P4 -n1 timeout 10 ipfs swarm connect
      esac
      exit 0
    '';
    type = "basic";
  }];
}