{
  inputs,
  pkgs,
  config,
  ...
}:
let
  unstable = import inputs.unstable { system = pkgs.stdenv.system; };
in
{
  users.users.actual = {
    isSystemUser = true;
    group = config.users.groups.actual.name;
  };
  users.groups.actual = { };
  services.actual = {
    package = unstable.actual-server;
    enable = true;
    openFirewall = true;
    user = config.users.users.actual.name;
    settings = {
      port = 3001;
      openId = {
        discoveryURL = "https://auth.shobu.fr";
        client_id = "actual-budget";
        client_secret._secret = config.age.secrets.actual-client_secret.path;
        server_hostname = "https://actual.shobu.fr";
        authMethod = "oauth2";
      };
    };
  };
}