{
  inputs,
  lib,
  pkgs,
  ...
}:
let
  allowMinecraft = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];

  unstable = import inputs.nixpkgs-unstable {
    inherit (pkgs.stdenv.hostPlatform) system;
    config.allowUnfreePredicate = allowMinecraft;
  };
in
{
  nixpkgs.config.allowUnfreePredicate = allowMinecraft;

  environment.systemPackages = [ pkgs.mcrcon ];

  networking.firewall.allowedTCPPorts = [ 25565 ];
  networking.firewall.allowedUDPPorts = [ 25565 ];

  services.minecraft-server = {
    enable = true;
    package = unstable.minecraft-server;
    eula = true;
    # openFirewall would also open rcon.port, so open the game port by hand
    openFirewall = false;
    declarative = true;
    whitelist = {
      mr_5aturn = "2b811fad-e419-401e-9185-70ab279219b5";
      CiderDonuts = "7a992778-71bc-4650-83a1-53069369481b";
      tallcafemocha = "a86f5a3d-cbe9-4248-800e-5863fbed19bf";
    };
    serverProperties = {
      server-port = 25565;
      view-distance = 32;
      difficulty = "normal";
      gamemode = "survival";
      max-players = 5;
      white-list = true;

      enable-rcon = true;
      "rcon.port" = 25575;
      "rcon.password" = "mooshroom";
    };
    jvmOpts = "-Xms4096M -Xmx4096M";
  };

  systemd.services.minecraft-server = {
    startLimitBurst = 5;
    startLimitIntervalSec = 300;
    serviceConfig = {
      NoNewPrivileges = true;

      ProtectSystem = "full";

      MemoryMax = "6G";
      TasksMax = 512;
      RestartSec = "10s";
    };
  };
}