{
  config,
  lib,
  ...
}:
{
  services.ddns-updater = {
    enable = true;
    environment = {
      PERIOD = "5m";
      # ddns-updater reads config from this path at runtime
      CONFIG_FILEPATH = config.age.secrets.ddns-updater-config.path;
    };
  };

  users.users.ddns-updater = {
    isSystemUser = true;
    group = "ddns-updater";
  };
  users.groups.ddns-updater = { };

  systemd.services.ddns-updater.serviceConfig = {
    DynamicUser = lib.mkForce false;
    User = "ddns-updater";
    Group = "ddns-updater";
  };
}