{ vars, ... }:

{
  services.beszel.agent.enable = true;
  services.beszel.agent.environment = {
    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
    HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.ports.beszelHub}";
  };

  # The upstream module runs beszel-agent under DynamicUser with
  # ProtectSystem = "strict" and no StateDirectory, so /var/lib/beszel-agent
  # (where the agent persists its hub-pairing fingerprint, per
  # https://github.com/henrygd/beszel/discussions/1542) isn't writable --
  # every restart silently fails to save it and regenerates a fresh one in
  # memory, permanently desyncing from whatever the hub has on record after
  # the very first successful pairing. Give it real persistent storage.
  systemd.services.beszel-agent.serviceConfig.StateDirectory = "beszel-agent";
}