{
  config,
  inputs,
  pkgs,
  ...
}: {
  services.rustfs = {
    enable = true;
    package = inputs.rustfs.packages.${pkgs.stdenv.hostPlatform.system}.default;

    # Reuse existing MinIO data directory
    volumes = "/var/storage/s3";

    # Keep same ports as MinIO to avoid changing Traefik and client configs
    address = ":3008";
    consoleEnable = true;
    consoleAddress = ":3007";

    # Credentials via agenix
    accessKeyFile = config.age.secrets.rustfs-access-key.path;
    secretKeyFile = config.age.secrets.rustfs-secret-key.path;

    logLevel = "info";
  };

  # Traefik configuration — same routes as before
  services.traefik.dynamicConfigOptions.http = {
    services.minio-console.loadBalancer.servers = [
      {
        url = "http://localhost:3007/";
      }
    ];
    services.minio.loadBalancer.servers = [
      {
        url = "http://localhost:3008/";
      }
    ];

    routers.minio = {
      rule = "Host(`s3.m3tam3re.com`)";
      tls = {
        certResolver = "godaddy";
      };
      service = "minio";
      entrypoints = "websecure";
    };
    routers.minio-console = {
      rule = "Host(`minio.m3tam3re.com`)";
      tls = {
        certResolver = "godaddy";
      };
      service = "minio-console";
      entrypoints = "websecure";
    };
  };
}