{
  self,
  hostPath,
  tree,
  inputs,
  pkgs,
  config,
  ...
}: let
  containerName = "forgejo";

  containerAddresses = import "${hostPath}/data/containerAddresses.nix";

  hostIP = containerAddresses.host;
  containerIP = containerAddresses.containers.${containerName};

  pathInContainer = path: "/var/lib/nixos-containers/${containerName}" + path;
in {
  containers.forgejo = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = hostIP;
    localAddress = containerIP;

    specialArgs = {
      inherit inputs;
      inherit tree;
      inherit self;
      inherit hostPath;
    };

    config = {...}: {
      nixpkgs.pkgs = pkgs;

      imports = with tree;
        [
          presets.nixos.containerBase
          profiles.sshd
          profiles.firewallAllow.ssh

          ./secrets.nix
        ]
        ++ (with hosts.hetzner-arm.containers.forgejo.profiles; [
          forgejo
          restic
        ]);

      networking.firewall.allowedTCPPorts = [2222];

      home-manager.users.root.home.stateVersion = "23.05";
      system.stateVersion = "23.05";
    };
  };

  networking = {
    nat.forwardPorts = [
      {
        sourcePort = 2222;
        destination = "${containerIP}\:2222";
      }
    ];

    firewall.allowedTCPPorts = [2222];
  };

  services.nginx = {
    enable = true;
    virtualHosts."forgejo.owo.monster" = {
      enableACME = true;
      forceSSL = true;
      locations."/".proxyPass = "http://unix:${pathInContainer "/var/sockets/forgejo.sock"}";
    };
  };
}