{
  pkgs,
  config,
  lib,
  ...
}:
let
  inherit (lib) types mkOption mkDefault;
  yaml = pkgs.formats.yaml { };
in
{
  options = {
    services.prometheus = {
      extraExporters = mkOption {
        type = types.attrsOf (
          types.submodule {
            options = {
              port = mkOption {
                type = types.int;
                description = "The port on which this exporter listens.";
              };
              listenAddress = mkOption {
                type = types.str;
                default = "127.0.0.1";
                description = "Address to listen on.";
              };
              serviceOpts = mkOption {
                type = types.attrs;
                description = "An attrset to be merged with the exporter's systemd service.";
              };
            };
          }
        );
      };
    };

    services.victoriametrics.scrapeConfigs = mkOption {
      type = types.attrsOf (
        types.submodule (
          { name, self, ... }:
          {
            options = {
              job_name = mkOption {
                type = types.str;
                default = name;
              };

              extraSettings = mkOption {
                type = types.anything;
                description = ''
                  Other settings to set for this scrape config.
                '';
                default = { };
              };

              targets = mkOption {
                type = types.listOf types.str;
                description = lib.mdDoc ''
                  Addresses scrape targets for this config listen on.

                  Shortcut for `static_configs = lib.singleton {targets = [<targets>];}`
                '';
                default = [ ];
              };

              static_configs = mkOption {
                default = [ ];
                type = types.listOf (
                  types.submodule {
                    options = {
                      targets = mkOption {
                        type = types.listOf types.str;
                        description = lib.mdDoc ''
                          The addresses scrape targets for this config listen on.

                          Must in `listenAddress:port` format.
                        '';
                      };
                      labels = mkOption {
                        type = types.attrsOf types.str;
                        description = lib.mdDoc ''
                          Labels to apply to all targets defined for this static config.
                        '';
                        default = { };
                      };
                    };
                  }
                );
              };
            };
          }
        )
      );
    };
  };

  config = {
    systemd.services = lib.mkMerge [
      (lib.mapAttrs' (
        name: exporter:
        lib.nameValuePair "prometheus-${name}-exporter" (
          lib.mkMerge [
            {
              # Shamelessly copied from upstream because the upstream
              # module is an intractable mess
              wantedBy = [ "multi-user.target" ];
              after = [ "network.target" ];
              serviceConfig.Restart = mkDefault "always";
              serviceConfig.PrivateTmp = mkDefault true;
              serviceConfig.WorkingDirectory = mkDefault /tmp;
              serviceConfig.DynamicUser = mkDefault true;
              # Hardening
              serviceConfig.CapabilityBoundingSet = mkDefault [ "" ];
              serviceConfig.DeviceAllow = [ "" ];
              serviceConfig.LockPersonality = true;
              serviceConfig.MemoryDenyWriteExecute = true;
              serviceConfig.NoNewPrivileges = true;
              serviceConfig.PrivateDevices = mkDefault true;
              serviceConfig.ProtectClock = mkDefault true;
              serviceConfig.ProtectControlGroups = true;
              serviceConfig.ProtectHome = true;
              serviceConfig.ProtectHostname = true;
              serviceConfig.ProtectKernelLogs = true;
              serviceConfig.ProtectKernelModules = true;
              serviceConfig.ProtectKernelTunables = true;
              serviceConfig.ProtectSystem = mkDefault "strict";
              serviceConfig.RemoveIPC = true;
              serviceConfig.RestrictAddressFamilies = [
                "AF_INET"
                "AF_INET6"
              ];
              serviceConfig.RestrictNamespaces = true;
              serviceConfig.RestrictRealtime = true;
              serviceConfig.RestrictSUIDSGID = true;
              serviceConfig.SystemCallArchitectures = "native";
              serviceConfig.UMask = "0077";
            }
            exporter.serviceOpts
          ]
        )
      ) config.services.prometheus.extraExporters)

      {
        vmagent-scrape-exporters =
          let
            listenAddress = config.services.victoriametrics.listenAddress;
            vmAddr = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress;
            promscrape = yaml.generate "prometheus.yml" {
              scrape_configs = lib.mapAttrsToList (
                _: scrape:
                lib.recursiveUpdate {
                  inherit (scrape) job_name;
                  static_configs =
                    scrape.static_configs
                    ++ lib.optional (scrape.targets != [ ]) { targets = scrape.targets; };
                } scrape.extraSettings
              ) config.services.victoriametrics.scrapeConfigs;
            };
          in
          {
            enable = true;
            path = [ pkgs.victoriametrics ];
            wantedBy = [ "multi-user.target" ];
            after = [
              "network.target"
              "victoriametrics.service"
            ];
            serviceConfig = {
              ExecStart = [
                (lib.concatStringsSep " " [
                  "${pkgs.victoriametrics}/bin/vmagent"
                  "-promscrape.config=${promscrape}"
                  "-remoteWrite.url=http://${vmAddr}/api/v1/write"
                  "-remoteWrite.tmpDataPath=%t/vmagent"
                ])
              ];
              SupplementaryGroups = "metrics";

              DynamicUser = true;
              RuntimeDirectory = "vmagent";
              CapabilityBoundingSet = [ "" ];
              DeviceAllow = [ "" ];
              LockPersonality = true;
              MemoryDenyWriteExecute = true;
              NoNewPrivileges = true;
              PrivateDevices = true;
              ProtectClock = true;
              ProtectControlGroups = true;
              ProtectHome = true;
              ProtectHostname = true;
              ProtectKernelLogs = true;
              ProtectKernelModules = true;
              ProtectKernelTunables = true;
              ProtectSystem = "strict";
              RemoveIPC = true;
              RestrictAddressFamilies = [
                "AF_INET"
                "AF_INET6"
              ];
              RestrictNamespaces = true;
              RestrictRealtime = true;
              RestrictSUIDSGID = true;
              SystemCallArchitectures = "native";
              UMask = "0077";
            };
          };
      }
    ];

    users.groups.metrics = { };

    services.victoriametrics.scrapeConfigs =
      let
        allExporters = lib.mapAttrs (name: exporter: { inherit (exporter) listenAddress port; }) (
          (lib.filterAttrs (
            _: exporter: builtins.isAttrs exporter && exporter.enable
          ) config.services.prometheus.exporters)
          // config.services.prometheus.extraExporters
        );
      in
      lib.mapAttrs (_: exporter: {
        targets = [ "${exporter.listenAddress}:${toString exporter.port}" ];
      }) allExporters;
  };
}