{
  lib,
  pkgs,
  user,
  ...
}:
let
  logGroup = "clamav-log";
  logDirectory = "clamav";
  logFile = "scan.log";
  logPath = "/var/log/${logDirectory}/${logFile}";
  scanRoot = "/";
in
{
  users.groups.${logGroup} = { };
  users.users.${user.username}.extraGroups = [ logGroup ]; # should be managed by home-manager

  services.clamav = {
    daemon = {
      enable = true;

      settings = {
        MaxThreads = 24;
        MaxQueue = 48;
        MaxFileSize = "100M";
        MaxScanSize = "300M";
        MaxDirectoryRecursion = 60;

        # AlertExceedsMax = true;

        # CommandReadTimeout = 0;
      };
    };

    updater = {
      enable = true;
      interval = "hourly";

      # Number of database checks per day used by freshclam.
      # Redundant if the updater is a one-shot service, though.
      # frequency = 24;
    };

    scanner = {
      enable = true;
      interval = "*-*-* 10:15:00";
    };
  };

  systemd.services.clamdscan = {
    # restartIfchanged = false;

    serviceConfig = {
      Group = logGroup;
      LogsDirectory = logDirectory;
      LogsDirectoryMode = "0750";
      Nice = 19;
      IOSchedulingClass = "idle";
      ExecStart = lib.mkForce ''
        ${pkgs.bash}/bin/bash -c ' \
          echo "Scanning directory ${scanRoot}"; \
          exec "${pkgs.clamav}/bin/clamdscan" \
            --log=${logPath} \
            --multiscan \
            --fdpass \
            --infected \
            --verbose \
            --file-list=<(${pkgs.findutils}/bin/find "${scanRoot}" \\( -path /proc -o -path /sys -o -path /dev -o -path /run -o -path /nix/store \\) -prune -o -type f -print) \
        '
      '';
    };
  };

  services.logrotate.settings.${logPath} = {
    frequency = "weekly";
    rotate = 8;

    dateext = true;

    compress = true;
    delaycompress = true;

    missingok = true;
    notifempty = true;
    create = "0640 root ${logGroup}";
  };

  systemd.services.clamav-daemon.serviceConfig = {
    LimitNOFILE = 8192;
  };

  systemd.timers.clamdscan.timerConfig = {
    Persistent = true;
    #RandomizedDelaySec = "2h";
  };
}