{
  lib,
  config,
  options,
  ...
}:
with lib; let
  cfg = config.virtualisation.pods;
  list-to-args = arg: list:
    concatStringsSep " " (map (e: "--${arg}=${escapeShellArg e}") list);
  possibly-unset-arg = arg: val: (optionalString (val != null) "--${arg}=${escapeShellArg val}");

  mkPod = name: pod: rec {
    path = [config.virtualisation.podman.package];

    wants = ["network.target"];
    after = ["network-online.target"];
    wantedBy = ["multi-user.target" "default.target"];

    environment.PODMAN_SYSTEMD_UNIT = "%n";

    preStart = concatStringsSep " " [
      "mkdir -p /run/podman/pods/ ;"
      "podman pod create"
      "--infra-conmon-pidfile=${escapeShellArg "/run/podman/pods/${name}.pid"}"
      "--name=${escapeShellArg name}"
      "--replace"
      (list-to-args "add-host" pod.added-hosts)
      (possibly-unset-arg "cgroup-parent" pod.cgroup-parent)
      (list-to-args "dns" pod.dns)
      (list-to-args "dns-opt" pod.dns-opt)
      (list-to-args "dns-search" pod.dns-search)
      (possibly-unset-arg "hostname" pod.hostname)
      (possibly-unset-arg "infra" pod.infra)
      (possibly-unset-arg "infra-command" pod.infra-command)
      (possibly-unset-arg "infra-image" pod.infra-image)
      (possibly-unset-arg "ip" pod.ip)
      (possibly-unset-arg "mac-address" pod.mac-address)
      (possibly-unset-arg "network" pod.network)
      (possibly-unset-arg "network-alias" pod.network-alias)
      (possibly-unset-arg "no-hosts" pod.no-hosts)
      (list-to-args "publish" pod.publish)
      (list-to-args "share" pod.share)
    ];

    script = "podman pod start ${escapeShellArg name}";
    preStop = "podman pod stop ${escapeShellArg name}";
    # `podman generate systemd` generates a second stop after the
    # first; not sure why but clearly it's recommended.
    postStop = preStop;

    serviceConfig = rec {
      Type = "forking";
      TimeoutStopSec = 70;
      Restart = "on-failure";
      PIDFile = "/run/podman/pods/${name}.pid";
    };
  };
in {
  options.virtualisation.pods = mkOption {
    type = with types;
      attrsOf (submodule {
        options = {
          added-hosts = mkOption {
            type = listOf str;
            default = [];
            description = "Additional hosts to add to /etc/hosts for each container.";
            example = literalExample ''
              [ "database:10.0.0.1" ]
            '';
          };

          cgroup-parent = mkOption {
            type = nullOr str;
            default = null;
            description = "The cgroups path under which the pod cgroup will be created.";
          };

          dns = mkOption {
            type = listOf str;
            default = [];
            description = "The dns servers to set in /etc/resolv.conf.";
          };

          dns-opt = mkOption {
            type = listOf str;
            default = [];
            description = "dns options to set in /etc/resolv.conf.";
          };

          dns-search = mkOption {
            type = listOf str;
            default = [];
            description = "Search domains to set in /etc/resolv.conf.";
          };

          hostname = mkOption {
            type = nullOr str;
            default = null;
            description = "The pod hostname.";
          };

          infra = mkOption {
            type = nullOr bool;
            default = null;
            description = "Whether to create the infra container for the pod.";
          };

          infra-command = mkOption {
            type = nullOr str;
            default = null;
            description = "The command to run in the infra container.";
          };

          infra-image = mkOption {
            type = nullOr str;
            default = null;
            description = "The image to use for the infra container.";
          };

          ip = mkOption {
            type = nullOr str;
            default = null;
            description = "A static IP address for the pod network.";
          };

          # TODO: set up label file stuff.
          #
          # labels = mkOption {};

          mac-address = mkOption {
            type = nullOr str;
            default = null;
            description = "A static mac address for the pod network.";
          };

          network = mkOption {
            type = nullOr str;
            default = null;
            description = "Network configuration for the pod.";
          };

          network-alias = mkOption {
            type = nullOr str;
            default = null;
            description = "DNS alias for the pod.";
          };

          no-hosts = mkOption {
            type = nullOr bool;
            default = null;
            description = "Whether to disable /etc/hosts creation for the pod.";
          };

          publish = mkOption {
            type = listOf str;
            default = [];
            description = "List of ports to publish from the pod.";
          };

          share = mkOption {
            type = listOf str;
            default = [];
            description = "List of kernel namespaces to share.";
          };

          containers = options.virtualisation.oci-containers.containers;
        };
      });
    default = {};
    description = "Podman pods to run as systemd services.";
  };

  config = let
    # Merge a list of attribute sets together
    #
    # TODO: See if there's a generic version for this somewhere in the
    # pkgs lib?
    mergeAttrs = attrList: foldr (a: b: a // b) {} attrList;

    # Create services for all defined pods
    pod-services = mapAttrs' (n: v: nameValuePair "pod-${n}" (mkPod n v)) cfg;

    # Override the systemd-specific settings of containers defined in
    # pods.
    #
    # I.e., make a systemd unit dependency on the pod service.
    pod-container-services = mergeAttrs (mapAttrsToList (pname: pod:
      mapAttrs' (cname: container:
        nameValuePair "podman-${pname}-${cname}" rec {
          after = ["pod-${pname}.service"];
          requires = after;
        })
      pod.containers)
    cfg);

    # Override the oci-container settings for containers defined in pods.
    #
    # I.e., set the --pod=podname setting, and update the dependsOn so
    # it points to containers in the same pod.
    podifyContainer = container: podname:
      container
      // {
        dependsOn =
          map (dependency: "${podname}-${dependency}") container.dependsOn;
        extraOptions = container.extraOptions ++ ["--pod=${podname}"];
      };
  in
    lib.mkIf (cfg != {}) {
      virtualisation.podman.enable = true;
      virtualisation.oci-containers.backend = "podman";

      systemd.services = pod-services // pod-container-services;

      virtualisation.oci-containers.containers = mergeAttrs (mapAttrsToList
        (pname: pod:
          mapAttrs' (cname: container:
            nameValuePair "${pname}-${cname}" (podifyContainer container pname))
          pod.containers)
        cfg);
    };
}