{
  config,
  options,
  lib,
  pkgs,
  ...
}:
let
  inherit (lib) mkIf mkOption mkEnableOption;
  inherit (lib.types) port bool;
  cfg = config.modules.container.paperless;
in
{
  options.modules.container.paperless = {
    enable = mkEnableOption "paperless";
    port = mkOption {
      default = 8000;
      description = "The port on which the paperless service will be reachable.";
      type = port;
    };
    openPort = mkOption {
      default = false;
      description = "Whether the port should be publicly accessible.";
      type = bool;
    };
    settings = options.services.paperless.settings;
  };

  config = mkIf cfg.enable {
    networking.firewall.allowedTCPPorts = mkIf cfg.openPort [ cfg.port ];

    services.paperless = {
      inherit (cfg) port enable settings;
      address = if cfg.openPort then "0.0.0.0" else "127.0.0.1";
    };
  };
}