{
  config,
  pkgs,
  lib,
  ...
}: let
  name = "radicle-stats";
in {
  systemd = {
    timers.${name} = {
      wantedBy = ["timers.target"];
      timerConfig = {
        OnBootSec = "1m";
        OnUnitActiveSec = "6h";
        Unit = "${name}.service";
      };
    };
    services = {
      ${name} = let
        cmd = "rad-system";
        rad =
          lib.findFirst (x: x.name == cmd) (throw "could not find `${cmd}`") config.environment.systemPackages;
      in {
        script = ''
          set -xeu
          mkdir -p /tmp/radicle
          ${lib.getExe rad} stats | ${lib.getExe pkgs.jq} --compact-output '. * { timestamp: now | strftime("%s") }' >> /tmp/radicle/stats.jsonl
        '';
        serviceConfig = {
          Type = "oneshot";
          User = "root";
        };
      };
      nginx.serviceConfig.BindReadOnlyPaths = [
        "/tmp/radicle/stats.jsonl:/tmp/radicle/stats.jsonl"
      ];
    };
  };
  services.nginx.virtualHosts.${config.networking.fqdn}.locations."/tmp/".alias = "/tmp/radicle/";
}