{config, ...}: let
  ghcrLogin = {
    registry = "ghcr.io";
    username = "nekowinston";
    passwordFile = config.age.secrets."containers/ghcr-token".path;
  };
  websitePort = "14139";
in {
  virtualisation.oci-containers.containers = {
    faerber-bot = {
      image = "ghcr.io/nekowinston/faerber/faerber-discord-bot:latest";
      environmentFiles = [
        config.age.secrets."containers/faerber.env".path
      ];
    };

    pepperjack = {
      image = "docker.io/phasecorex/red-discordbot:latest";
      environment = {
        TOKEN = "~";
        OWNER = "505490445468696576";
      };
      environmentFiles = [
        config.age.secrets."containers/pepperjack.env".path
      ];
      volumes = [
        "/srv/data-pepperjack:/data"
      ];
    };

    website = {
      image = "ghcr.io/nekowinston/winston.sh/winston-sh:latest";
      login = ghcrLogin;
      ports = ["127.0.0.1:${websitePort}:3000"];
    };
  };

  services.nginx.virtualHosts."winston.sh" = {
    locations."/".proxyPass = "http://127.0.0.1:${websitePort}";
    forceSSL = true;

    enableACME = false;
    useACMEHost = "winston.sh";
  };
}