{ config, pkgs, hostname, ... }: {
  # Telegraf Monitoring
  
  sops.secrets.telegraf-token = {
    owner = "telegraf";
    sopsFile = ../secrets/secrets.yaml;
    restartUnits = [ "telegraf.service" ];
  };

  users.users.telegraf = {
    extraGroups = [ "wheel" ];
    isNormalUser = true;
  };

  # Install the package
  environment.systemPackages = with pkgs; [
    lm_sensors
    telegraf
    smartmontools
  ];

  # Allow telegraf to talk to other executables it requires:
  systemd.services.telegraf = {
    path = with pkgs; [ 
      lm_sensors                # sensors
      fail2ban                  # fail2ban-client
      linuxPackages.nvidia_x11  # nvidia-smi
      smartmontools             # smartctl
      sudo                      # sudo
     ];
  };

  # Configure the package:
  services.telegraf = {
    enable = true;
    environmentFiles = [ /run/secrets/telegraf-token ];
    extraConfig = {
      outputs = { 
        influxdb_v2 = {
          urls = [ "https://influx.sysctl.io/" ];
          token = "$TELEGRAF_TOKEN";
          organization = "default";
          bucket = "telegrafdb";
          http_headers = { Authorization = "Token $TELEGRAF_TOKEN"; };
        };
      };
      inputs = {
        cpu = {
          percpu = true;
          totalcpu = true;
          collect_cpu_time = false;
          report_active = false;
        };
        disk = {
          ignore_fs = ["tmpfs" "devtmpfs" "devfs" "iso9660" "overlay" "aufs" "squashfs"];
        };
        diskio = {};
        kernel = {};
        mem = {};
        processes = {};
        swap = {};
        system = {};
        fail2ban = {
          use_sudo = true;
        };
        intel_powerstat = {};
        net = {};
        nvidia_smi = {};
        sensors = {};
        smart = {
          timeout = "30s";
        };
        temp = {};
        wireless = {};
      };
    };
  };
}