{
  self,
  hostPath,
  tree,
  inputs,
  config,
  pkgs,
  ...
}: let
  containerAddresses = import "${hostPath}/data/containerAddresses.nix";
  hostIP = containerAddresses.host;
  containerIP = containerAddresses.containers.vault-ca;
in {
  containers.vault-ca = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = hostIP;
    localAddress = containerIP;
    additionalCapabilities = ["CAP_IPC_LOCK"];

    specialArgs = {
      inherit inputs;
      inherit tree;
      inherit self;
      inherit hostPath;
    };

    config = {...}: {
      nixpkgs.pkgs = pkgs;

      imports = with tree;
        [
          presets.nixos.containerBase
          ./secrets.nix
        ]
        ++ (with hosts.hetzner-arm.containers.vault-ca.profiles; [
          vault
          #internalCA
          restic
        ]);

      networking.firewall.allowedTCPPorts = [8200 8443];

      home-manager.users.root.home.stateVersion = "23.05";
      system.stateVersion = "23.05";
    };
  };

  services.nginx.virtualHosts."vault.owo.monster" = {
    forceSSL = true;
    enableACME = true;
    locations = {
      "/".proxyPass = "http://${containerIP}:8200";
    };
  };

  # TODO: redo this
  #security.acme.certs."vault.genderfucked.monster" = {
  #  server = "https://internal-ca.genderfucked.monster:8443/acme/acme/directory";
  #};

  #services.nginx.virtualHosts."vault.genderfucked.monster" = {
  #  forceSSL = true;
  #  enableACME = true;
  #  locations = {
  #    "/".proxyPass = "http://${containerIP}:8200";
  #  };
  #};
}