{self, ...}: let
  internalWireGuard = import "${self}/data/chaosInternalWireGuard.nix";
  ports = import ../data/ports.nix;
in {
  services.cockroachdb-bin = {
    enable = true;
    certsDir = "/var/lib/cockroachdb-certs";
    join = "localhost:${toString ports.cockroachdb},${internalWireGuard.hosts.raspberry.ip}:26257";
    # ssh -L 3014:127.0.0.1:3014 -L 26257:127.0.0.1:26257 raspberry
    extraArgs = ["--advertise-addr=${internalWireGuard.hosts.hetzner-vm.ip}:26257"];
    listen = {
      port = ports.cockroachdb;
      address = "0.0.0.0";
    };
    http = {
      address = "0.0.0.0";
      port = ports.cockroachdb-http;
    };
  };
}