{ config, pkgs, deployment, ... }: {
  imports = [ ../../common ../../common/lxc.nix ];
  networking.hostName = "minio";
  system.stateVersion = "21.11";

  networking.firewall.enable = false;
  networking.firewall.allowedTCPPorts = [ 9000 9001 ];

  services.minio = {
    enable = true;
    rootCredentialsFile = "/var/lib/keys/minioSettings";
  };
  deployment.keys."minioSettings" = {
    keyCommand = [ "vault" "kv" "get" "-field=settings" "kv/minio" ];
    destDir = "/var/lib/keys";
    user = "minio";
    group = "minio";
  };
}