{
  config,
  lib,
  ...
}: let
  cfg = config.services.tangled.cilogs;
in
  with lib; {
    options.services.tangled.cilogs = {
      enable = mkEnableOption "ssh server that follows a ci run's logs in a terminal";

      package = mkOption {
        type = types.package;
        description = "cilogs package to run";
      };

      listenAddr = mkOption {
        type = types.str;
        default = "0.0.0.0:3333";
        description = "address the ssh server listens on, the host:port a spindle's logsAddr names";
      };

      hostKeyPath = mkOption {
        type = types.str;
        default = "/var/lib/cilogs/ssh_host_ed25519_key";
        description = "ssh host key, made on first start when missing";
      };

      plcUrl = mkOption {
        type = types.str;
        default = "https://plc.directory";
        description = "plc directory that resolves repo dids";
      };
    };

    config = mkIf cfg.enable {
      systemd.services.cilogs = {
        description = "tangled ci logs over ssh";
        after = ["network-online.target"];
        wants = ["network-online.target"];
        wantedBy = ["multi-user.target"];
        serviceConfig = {
          Environment = [
            "CILOGS_LISTEN_ADDR=${cfg.listenAddr}"
            "CILOGS_HOST_KEY_PATH=${cfg.hostKeyPath}"
            "CILOGS_PLC_URL=${cfg.plcUrl}"
          ];
          ExecStart = getExe cfg.package;
          Restart = "always";
          DynamicUser = true;
          StateDirectory = "cilogs";
        };
      };
    };
  }