{
  config,
  pkgs,
  lib,
  ...
}:
let
  cfg = config.modules.fixes.services.rsyncd;
  settingsFormat = pkgs.formats.iniWithGlobalSection { };
  configFile = settingsFormat.generate "rsyncd.conf" cfg.settings;
in
{
  options.modules.fixes.services.rsyncd = {
    enable = lib.mkEnableOption "the rsync daemon";

    port = lib.mkOption {
      default = 873;
      type = lib.types.port;
      description = "TCP port the daemon will listen on.";
    };

    settings = lib.mkOption {
      type = settingsFormat.type;
      default = { };
      example = {
        globalSection = {
          uid = "nobody";
          gid = "nobody";
          "use chroot" = true;
          "max connections" = 4;
        };
        sections = {
          ftp = {
            path = "/var/ftp/./pub";
            comment = "whole ftp area";
          };
          cvs = {
            path = "/data/cvs";
            comment = "CVS repository (requires authentication)";
            "auth users" = [
              "tridge"
              "susan"
            ];
            "secrets file" = "/etc/rsyncd.secrets";
          };
        };
      };
      description = ''
        Configuration for rsyncd. See
        {manpage}`rsyncd.conf(5)`.
      '';
    };

    socketActivated = lib.mkOption {
      default = false;
      type = lib.types.bool;
      description = "If enabled Rsync will be socket-activated rather than run persistently.";
    };

  };

  config = lib.mkIf cfg.enable {
    systemd =
      let
        serviceConfigSecurity = {
          ProtectSystem = "full";
          PrivateDevices = "on";
          NoNewPrivileges = "on";
        };
      in
      {
        services.rsync = lib.mkForce {
          enable = !cfg.socketActivated;
          aliases = [ "rsyncd.service" ];

          description = "fast remote file copy program daemon";
          after = [ "network.target" ];
          documentation = [
            "man:rsync(1)"
            "man:rsyncd.conf(5)"
          ];

          serviceConfig = serviceConfigSecurity // {
            ExecStart = "${pkgs.rsync}/bin/rsync --daemon --no-detach --config=${configFile}";
            RestartSec = 1;
          };

          wantedBy = [ "multi-user.target" ];
        };

        services."rsync@" = lib.mkForce {
          description = "fast remote file copy program daemon";
          after = [ "network.target" ];

          serviceConfig = serviceConfigSecurity // {
            ExecStart = "${pkgs.rsync}/bin/rsync --daemon --config=${configFile}";
            StandardInput = "socket";
            StandardOutput = "inherit";
            StandardError = "journal";
          };
        };

        sockets.rsync = lib.mkForce {
          enable = cfg.socketActivated;

          description = "socket for fast remote file copy program daemon";
          conflicts = [ "rsync.service" ];

          listenStreams = [ (toString cfg.port) ];
          socketConfig.Accept = true;

          wantedBy = [ "sockets.target" ];
        };
      };

  };
}