{ config, vars, ... }:

{
  # Universal token shared by all beszel agents. Add to secrets/common.yaml:
  #   sops secrets/common.yaml
  #   beszel-token: <value from the beszel hub UI>
  sops.secrets."beszel-token" = { };

  sops.templates."beszel.env".content = ''
    TOKEN=${config.sops.placeholder."beszel-token"}
  '';

  services.beszel.agent = {
    enable = true;
    environmentFile = config.sops.templates."beszel.env".path;
    environment = {
      #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
      HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.ports.beszelHub}";
    };
  };

  # The upstream module runs beszel-agent under DynamicUser with
  # ProtectSystem = "strict" and no StateDirectory, so /var/lib/beszel-agent
  # (where the agent persists its hub-pairing fingerprint, per
  # https://github.com/henrygd/beszel/discussions/1542) isn't writable --
  # every restart silently fails to save it and regenerates a fresh one in
  # memory, permanently desyncing from whatever the hub has on record after
  # the very first successful pairing. Give it real persistent storage.
  systemd.services.beszel-agent.serviceConfig.StateDirectory = "beszel-agent";
}