{config, ...}: let
  inherit (config) sops;
  inherit (sops) templates placeholder;

  toAppRegistration = {
    port,
    id,
    as_token,
    hs_token,
    sender_localpart,
    rate_limited ? false,
    ...
  } @ conf:
    builtins.toJSON ({
        namespaces = {
          users = [
            {
              exclusive = true;
              regex = "^@${id}_.*:tristans.cloud$";
            }
            {
              exclusive = true;
              regex = "^@${id}bot:tristans.cloud$";
            }
          ];
        };
        url = "http://localhost:${toString port}";
      }
      // conf);
in {
  sops.secrets = {
    "mautrix-whatsapp/as_token" = {};
    "mautrix-whatsapp/hs_token" = {};
  };
  sops.templates = {
    "mautrix-whatsapp/appservice.yaml" = {
      owner = "matrix-synapse";
      content = toAppRegistration {
        id = "whatsapp";
        port = config.services.mautrix-whatsapp.settings.appservice.port;
        as_token = placeholder."mautrix-whatsapp/as_token";
        hs_token = placeholder."mautrix-whatsapp/hs_token";
        sender_localpart = "Gx8tLTHsxVlrdD3qibaPdaP9t7GhfciV";
        "de.sorunome.msc2409.push_ephemeral" = true;
      };
    };
    # "mautrix-whatsapp/env".content = ''
    #   MAUTRIX_WHATSAPP_APPSERVICE_AS_TOKEN=${placeholder."mautrix-whatsapp/as_token"}
    #   MAUTRIX_WHATSAPP_APPSERVICE_HS_TOKEN=${placeholder."mautrix-whatsapp/hs_token"}
    # '';
  };

  services.mautrix-whatsapp = {
    enable = true;
    # environmentFile = templates."mautrix-whatsapp/env".path;
    settings = {
      homeserver = {
        address = "http://localhost:8008";
        domain = "tristans.cloud";
      };
      bridge = {
        permissions = {
          "tristans.cloud" = "user";
          "@tristan:tristans.cloud" = "admin";
        };
        encryption = {
          allow = true;
          appservice = false;
        };
        personal_filtering_spaces = true;
      };
    };
  };

  services.matrix-synapse.settings.app_service_config_files = [
    templates."mautrix-whatsapp/appservice.yaml".path
    # "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml"
  ];
}