{ config, ... }:
let
  domain = config.selfprivacy.domain;
in
{
  users.groups.ocserv = {
    members = [ "ocserv" ];
  };
  users.users.ocserv = {
    isNormalUser = false;
    isSystemUser = true;
    extraGroups = [ "ocserv" "acmerecievers" ];
    group = "ocserv";
  };
  services.ocserv = {
    enable = config.selfprivacy.ocserv.enable;
    config = ''
      socket-file = /var/run/ocserv-socket

      auth = "pam"

      tcp-port = 8443
      udp-port = 8443

      server-cert = /var/lib/acme/${domain}/fullchain.pem
      server-key = /var/lib/acme/${domain}/key.pem

      compression = true

      max-clients = 0
      max-same-clients = 6

      try-mtu-discovery = true

      idle-timeout=1200
      mobile-idle-timeout=2400

      default-domain = vpn.${domain}

      device = vpn0

      ipv4-network = 10.10.10.0
      ipv4-netmask = 255.255.255.0

      tunnel-all-dns = true
      dns = 1.1.1.1
      dns = 1.0.0.1

      route = default
    '';
  };
}