{ pkgs, config, ... }:
{
  services.factorio = {
    enable = true;
    package = pkgs.factorio-headless.override { versionsJson = ./versions.json; };
    extraArgs = [
      "--rcon-bind=localhost:27015"
      "--rcon-password=$(cat ${config.sops.secrets."factorio/rconpass".path})"
    ];
  };
  sops.secrets."factorio/rconpass" = {};
  networking.firewall.allowedUDPPorts = [ 34197 ];
}