{
  config,
  lib,
  pkgs,
  namespace,
  ...
}:
let
  name = "cockpit";
  cfg = config.${namespace}.services.${name};
  net = lib.${namespace}.network;

  cockpitConfig = lib.${namespace}.mkModule {
    inherit config name;
    description = "Cockpit web-based server management UI";
    moduleConfig = {
      services.cockpit = {
        enable = true;
        port = cfg.port;
        openFirewall = cfg.openFirewall;
        allowed-origins = [
          "https://${net.hosts.nas.lan}:${toString cfg.port}"
          "https://${net.hosts.nas.hostname}:${toString cfg.port}"
          "https://${net.hosts.nas.hostname}.local:${toString cfg.port}"
        ];
        plugins = with pkgs.${namespace}; [
          # cockpit-benchmark
          cockpit-podman
          cockpit-machines
        ];
      };
    };
  };
in
{
  imports = [ cockpitConfig ];
}