{
  service_configs,
  lib,
  ...
}:
{
  imports = [
    (lib.serviceMountWithZpool "monero" service_configs.zpool_hdds [
      service_configs.monero.dataDir
    ])
    (lib.serviceFilePerms "monero" [
      "Z ${service_configs.monero.dataDir} 0700 monero monero"
    ])
  ];

  services.monero = {
    enable = true;
    dataDir = service_configs.monero.dataDir;
    rpc = {
      address = "0.0.0.0";
      port = service_configs.ports.monero_rpc;
      restricted = true;
    };
    extraConfig = ''
      p2p-bind-port=${builtins.toString service_configs.ports.monero}
      db-sync-mode=fast:async:1000000000bytes
      public-node=1
      confirm-external-bind=1
    '';
  };

  networking.firewall.allowedTCPPorts = [
    service_configs.ports.monero
    service_configs.ports.monero_rpc
  ];
}