{ config, pkgs, ... }:
{
  services.netdata = {
    enable = true;
    # package = pkgs.netdataCloud;
    package = pkgs.netdata.override {
      withCloudUi = true;
    };
    configDir."python.d.conf" = pkgs.writeText "python.d.conf" ''
      samba: yes
    '';
    # claimTokenFile = config.sops.secrets."jallen-nas/netdata-token".path;

    config = {
      # enable machine learning plugin
      ml = {
        "enabled" = "yes";
      };

      # enable samba plugin
      plugins = {
        "enable running new plugins" = "yes";
        "ioping.plugin" = "yes";
        "freeipmi.plugin" = "yes";
        "perf.plugin" = "yes";
      };
    };
  };

  # add samba and sudo to path of python plugin
  systemd.services.netdata.path = [  pkgs.samba "/run/wrappers" ];

  # permit to run sudo smbstatus -P
  security.sudo.extraConfig = ''
    netdata ALL=(root) NOPASSWD: ${pkgs.samba}/bin/smbstatus
  '';

  # as documented here : https://github.com/netdata/netdata/blob/master/system/netdata.service.in
  # review capabilityset above if other plugins are non functional
  systemd.services.netdata.serviceConfig.CapabilityBoundingSet = ["CAP_SETGID"];
}