{
  config,
  pkgs,
  lib,
  ...
}: let
  cfg = config.services.pocketbase;
in {
  options.services.pocketbase = {
    enable = lib.mkEnableOption "PocketBase backend";

    dataDir = lib.mkOption {
      type = lib.types.path;
      default = "/var/lib/pocketbase";
      description = "Working directory containing the PocketBase binary and data.";
    };

    openFirewall = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = ''
        Open ports in the firewall for the PocketBase web interface
      '';
    };

    port = lib.mkOption {
      type = lib.types.int;
      default = 8090;
      description = "The port number for the PocketBase.";
    };

    user = lib.mkOption {
      type = lib.types.str;
      default = "root";
      description = "User to run the PocketBase service as.";
    };

    group = lib.mkOption {
      type = lib.types.str;
      default = "root";
      description = "Group to run the PocketBase service as.";
    };

    logFile = lib.mkOption {
      type = lib.types.path;
      default = "/var/lib/pocketbase/std.log";
      description = "Log file used for both stdout and stderr.";
    };

    package = lib.mkPackageOption pkgs "pocketbase" {};
  };

  config = lib.mkIf cfg.enable {
    # Optional: ensure the directory exists with proper ownership
    systemd.tmpfiles.rules = [
      "d ${cfg.dataDir} 0700 ${cfg.user} ${cfg.group} -"
    ];

    systemd.services.pocketbase = {
      description = "PocketBase";
      wantedBy = ["multi-user.target"];
      after = ["network.target"];

      serviceConfig = {
        Type = "simple";
        User = cfg.user;
        Group = cfg.group;
        LimitNOFILE = 4096;
        Restart = "always";
        RestartSec = 5;
        WorkingDirectory = cfg.dataDir;

        ExecStart = ''
          ${lib.getExe cfg.package} serve --dir ${cfg.dataDir}/pb_data --http=0.0.0.0:${toString cfg.port}
        '';

        # Switch to systemd stdout/stderr logging by default
        # and optionally use append: style if you want exactly your example
        StandardOutput = "append:${cfg.logFile}";
        StandardError = "append:${cfg.logFile}";
      };
    };
    networking.firewall = lib.mkIf cfg.openFirewall {
      allowedTCPPorts = [cfg.port];
    };
  };
}