{ ... }:
{
  services.actual = {
    enable = true;
    openFirewall = true;
    settings = {
      trustedProxies = [ "10.0.1.18" ];
      port = 3333;
      config = {
        dataDir = "/media/nas/ssd/nix-app-data/actual";
        openId = {
          issuer = "https://authentik.mjallen.dev/application/o/actual-budget/";
          client_id = "1PGCrRdndq7SoOSLuNMnXFmHpgd1NKRMOa5LSia2";
          client_secret = "1PGCrRdndq7SoOSLuNMnXFmHpgd1NKRMOa5LSia2";
          server_hostname = "https://actual.mjallen.dev";
          authMethod = "openid";
        };
      };
    };
  };
}