{ config, pkgs, inputs, lib, ... }: {
  imports = [ ../nginx.nix ];

  services.nginx = {
    virtualHosts = {
      "notes.purrfect.estate" = {
        forceSSL = true;
        enableACME = true;
        serverAliases = [ "notes-sandbox.purrfect.estate" ];
        locations."/" = {
          proxyPass = "http://127.0.0.1:9005";
          proxyWebsockets = true;
        };
      };
    };
  };
  virtualisation.oci-containers.containers.cryptpad = {
    image =
      "promasu/cryptpad@sha256:29c61f69e41173188c0592e72f2273cf23a83f48e7d143337e2cd7fea441ed87";
    volumes = [
      "${./cryptpad.config.js}:/cryptpad/config/config.js"

      "cryptpad_blob:/cryptpad/blob"
      "cryptpad_block:/cryptpad/block"
      "cryptpad_customize:/cryptpad/customize"
      "cryptpad_data:/cryptpad/data"
      "cryptpad_data_files:/cryptpad/datastore"
    ];
    environment = {
      CPAD_MAIN_DOMAIN = "notes.purrfect.estate";
      CPAD_SANDBOX_DOMAIN = "notes-sandbox.purrfect.estate";
      CPAD_REALIP_HEADER = "X-Forwarded-For";
      CPAD_REALIP_RECURSIVE = "on";
      CPAD_TRUSTED_PROXY = "0.0.0.0/0";
      CPAD_HTTP2_DISABLE = "true";
    };
    ports = [ "9005:80" ];
  };
}