{
  pkgs,
  config,
  lib,
  ...
}: let
  inherit (lib) types mkOption mkDefault;
  yaml = pkgs.formats.yaml {};
in {
  options = {
    services.prometheus = {
      extraExporters = mkOption {
        type = types.attrsOf (types.submodule {
          options = {
            port = mkOption {
              type = types.int;
              description = "The port on which this exporter listens.";
            };
            listenAddress = mkOption {
              type = types.str;
              default = "127.0.0.1";
              description = "Address to listen on.";
            };
            serviceOpts = mkOption {
              type = types.attrs;
              description = "An attrset to be merged with the exporter's systemd service.";
            };
          };
        });
      };
    };

    services.victoriametrics.scrapeConfigs = mkOption {
      type = types.attrsOf (types.submodule ({
        name,
        self,
        ...
      }: {
        options = {
          job_name = mkOption {
            type = types.str;
            default = name;
          };

          extraSettings = mkOption {
            type = types.anything;
            description = ''
              Other settings to set for this scrape config.
            '';
            default = {};
          };

          targets = mkOption {
            type = types.listOf types.str;
            description = lib.mdDoc ''
              Addresses scrape targets for this config listen on.

              Shortcut for `static_configs = lib.singleton {targets = [<targets>];}`
            '';
            default = [];
          };

          static_configs = mkOption {
            default = [];
            type = types.listOf (types.submodule {
              options = {
                targets = mkOption {
                  type = types.listOf types.str;
                  description = lib.mdDoc ''
                    The addresses scrape targets for this config listen on.

                    Must in `listenAddress:port` format.
                  '';
                };
                labels = mkOption {
                  type = types.attrsOf types.str;
                  description = lib.mdDoc ''
                    Labels to apply to all targets defined for this static config.
                  '';
                  default = {};
                };
              };
            });
          };
        };
      }));
    };
  };

  config = {
    systemd.services = lib.mkMerge [
      (lib.mapAttrs' (name: exporter:
        lib.nameValuePair "prometheus-${name}-exporter" (lib.mkMerge [
          {
            # Shamelessly copied from upstream because the upstream
            # module is an intractable mess
            wantedBy = ["multi-user.target"];
            after = ["network.target"];
            serviceConfig.Restart = mkDefault "always";
            serviceConfig.PrivateTmp = mkDefault true;
            serviceConfig.WorkingDirectory = mkDefault /tmp;
            serviceConfig.DynamicUser = mkDefault true;
            # Hardening
            serviceConfig.CapabilityBoundingSet = mkDefault [""];
            serviceConfig.DeviceAllow = [""];
            serviceConfig.LockPersonality = true;
            serviceConfig.MemoryDenyWriteExecute = true;
            serviceConfig.NoNewPrivileges = true;
            serviceConfig.PrivateDevices = mkDefault true;
            serviceConfig.ProtectClock = mkDefault true;
            serviceConfig.ProtectControlGroups = true;
            serviceConfig.ProtectHome = true;
            serviceConfig.ProtectHostname = true;
            serviceConfig.ProtectKernelLogs = true;
            serviceConfig.ProtectKernelModules = true;
            serviceConfig.ProtectKernelTunables = true;
            serviceConfig.ProtectSystem = mkDefault "strict";
            serviceConfig.RemoveIPC = true;
            serviceConfig.RestrictAddressFamilies = ["AF_INET" "AF_INET6"];
            serviceConfig.RestrictNamespaces = true;
            serviceConfig.RestrictRealtime = true;
            serviceConfig.RestrictSUIDSGID = true;
            serviceConfig.SystemCallArchitectures = "native";
            serviceConfig.UMask = "0077";
          }
          exporter.serviceOpts
        ]))
      config.services.prometheus.extraExporters)

      {
        vmagent-scrape-exporters = let
          listenAddress = config.services.victoriametrics.listenAddress;
          vmAddr = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress;
          promscrape = yaml.generate "prometheus.yml" {
            scrape_configs = lib.mapAttrsToList (_: scrape:
              lib.recursiveUpdate {
                inherit (scrape) job_name;
                static_configs =
                  scrape.static_configs
                  ++ lib.optional (scrape.targets != []) {targets = scrape.targets;};
              }
              scrape.extraSettings)
            config.services.victoriametrics.scrapeConfigs;
          };
        in {
          enable = true;
          path = [pkgs.victoriametrics];
          wantedBy = ["multi-user.target"];
          after = ["network.target" "victoriametrics.service"];
          serviceConfig = {
            ExecStart = [
              (lib.concatStringsSep " " [
                "${pkgs.victoriametrics}/bin/vmagent"
                "-promscrape.config=${promscrape}"
                "-remoteWrite.url=http://${vmAddr}/api/v1/write"
                "-remoteWrite.tmpDataPath=%t/vmagent"
              ])
            ];
            SupplementaryGroups = "metrics";

            DynamicUser = true;
            RuntimeDirectory = "vmagent";
            CapabilityBoundingSet = [""];
            DeviceAllow = [""];
            LockPersonality = true;
            MemoryDenyWriteExecute = true;
            NoNewPrivileges = true;
            PrivateDevices = true;
            ProtectClock = true;
            ProtectControlGroups = true;
            ProtectHome = true;
            ProtectHostname = true;
            ProtectKernelLogs = true;
            ProtectKernelModules = true;
            ProtectKernelTunables = true;
            ProtectSystem = "strict";
            RemoveIPC = true;
            RestrictAddressFamilies = ["AF_INET" "AF_INET6"];
            RestrictNamespaces = true;
            RestrictRealtime = true;
            RestrictSUIDSGID = true;
            SystemCallArchitectures = "native";
            UMask = "0077";
          };
        };
      }
    ];

    users.groups.metrics = {};

    services.victoriametrics.scrapeConfigs = let
      allExporters =
        lib.mapAttrs (name: exporter: {
          inherit (exporter) listenAddress port;
        }) ((lib.filterAttrs (_: exporter: builtins.isAttrs exporter && exporter.enable)
          config.services.prometheus.exporters)
        // config.services.prometheus.extraExporters);
    in
      lib.mapAttrs (_: exporter: {
        targets = ["${exporter.listenAddress}:${toString exporter.port}"];
      })
      allExporters;
  };
}