{
  config,
  pkgs,
  inputs,
  lib,
  ...
}: {
  imports = [../nginx.nix];

  services.nginx = {
    virtualHosts = {
      "notes.purrfect.estate" = {
        forceSSL = true;
        enableACME = true;
        serverAliases = ["notes-sandbox.purrfect.estate"];
        locations."/" = {
          proxyPass = "http://127.0.0.1:9005";
          proxyWebsockets = true;
        };
      };
    };
  };
  virtualisation.oci-containers.containers.cryptpad = {
    image = "promasu/cryptpad:nginx";
    volumes = [
      "${./cryptpad.config.js}:/cryptpad/config/config.js"

      "cryptpad_blob:/cryptpad/blob"
      "cryptpad_block:/cryptpad/block"
      "cryptpad_customize:/cryptpad/customize"
      "cryptpad_data:/cryptpad/data"
      "cryptpad_data_files:/cryptpad/datastore"
    ];
    environment = {
      CPAD_MAIN_DOMAIN = "notes.purrfect.estate";
      CPAD_SANDBOX_DOMAIN = "notes-sandbox.purrfect.estate";
      CPAD_REALIP_HEADER = "X-Forwarded-For";
      CPAD_REALIP_RECURSIVE = "on";
      CPAD_TRUSTED_PROXY = "0.0.0.0/0";
      CPAD_HTTP2_DISABLE = "true";
    };
    ports = ["9005:80"];
  };
}