{
  pkgs,
  config,
  ...
}:
let
  domain = "login.kaareskovgaard.net";
  provisionServiceAccount = pkgs.writeShellApplication {
    runtimeInputs = [
      config.services.kanidm.package
      pkgs.uutils-coreutils-noprefix
      pkgs.jq
      pkgs.gnugrep
      pkgs.expect
    ];
    name = "kanidm-provision-dovecot-service-account";
    text = ''
      KANIDM_URL="https://${domain}"
      export KANIDM_URL
      >&2 echo "Resetting password for idm_admin, please provide sudo password"
      password="$(sudo -u kanidm kanidmd recover-account -c /etc/kanidm/server.toml -o json idm_admin 2> /dev/null | grep '^{' | jq --raw-output '.password')"
      expect <<EOD >&2
      spawn kanidm login --name idm_admin
      expect "Enter password"
      send "$password\n"
      expect eof
      EOD
      trap "kanidm logout > /dev/null" EXIT

      dovecot_svc="$(kanidm service-account get dovecot_ldap)"
      if [[ "$dovecot_svc" == "No matching entries" ]]; then
        kanidm service-account create dovecot_ldap "Dovecot LDAP" admin >&2
      fi
      kanidm group set-members idm_mail_servers dovecot_ldap >&2
      kanidm logout
      password="$(sudo -u kanidm kanidmd recover-account -c /etc/kanidm/server.toml -o json admin 2> /dev/null | grep '^{' | jq --raw-output '.password')"
      expect <<EOD >&2
      spawn kanidm login --name admin
      expect "Enter password"
      send "$password\n"
      expect eof
      EOD

      api_token="$(kanidm service-account api-token status dovecot_ldap)"
      if [[ "$api_token" != "No api tokens exist" ]]; then
        # Output is currently some lines, one of which starts with 'token_id: ' and then followed by the token id. So extract it
        token_id="$(echo "$api_token" | awk '/^token_id: /{print $2}')"
        kanidm service-account api-token destroy dovecot_ldap "$token_id" >&2
      fi
      token="$(kanidm service-account api-token generate dovecot_ldap "LDAP")"

      echo "$token" | tail -n1
    '';
  };
  setPosixPassword = pkgs.writeShellApplication {
    runtimeInputs = [
      config.services.kanidm.package
      pkgs.uutils-coreutils-noprefix
      pkgs.jq
      pkgs.gnugrep
      pkgs.expect
    ];
    name = "kanidm-set-posix-password";
    text = ''
      user="''${1:-}"
      if [[ "$user" == "" ]]; then
        >&2 echo "Usage kanidm-set-posix-password <user>"
        exit 1
      fi
      KANIDM_URL="https://${domain}"
      export KANIDM_URL
      >&2 echo "Resetting password for idm_admin, please provide sudo password"
      password="$(sudo -u kanidm kanidmd recover-account -c /etc/kanidm/server.toml -o json idm_admin 2> /dev/null | grep '^{' | jq --raw-output '.password')"
      expect <<EOD >&2
      spawn kanidm login --name idm_admin
      expect "Enter password"
      send "$password\n"
      expect eof
      EOD
      trap "kanidm logout > /dev/null" EXIT
      kanidm person posix set --name idm_admin "$user"
    '';
  };
in
{
  config = {
    environment.systemPackages = [
      provisionServiceAccount
      setPosixPassword
    ];
  };
}
