{ config, lib, pkgs, ... }:
{
  services.kea.dhcp4 = {
    configFile = config.sops.secrets.kea-dhcp4_conf.path;
    enable = true;
  };

  systemd.services.kea-dhcp4-server = {
    serviceConfig = {
      ExecStart = lib.mkForce ''
        ${pkgs.kea}/bin/kea-dhcp4 -c ''${CREDENTIALS_DIRECTORY}/kea-dhcp4_conf
      '';
      LoadCredential = [ "kea-dhcp4_conf:${config.sops.secrets.kea-dhcp4_conf.path}" ];
    };
  };
}