{
  tree,
  lib,
  inputs,
  config,
  pkgs,
  ...
}: let
  container-addresses = import ../../data/container-addresses.nix {};
  hostIP = container-addresses.host;
  containerIP = container-addresses.containers.piped;

  ports = import ./data/ports.nix {};

  # Using secrets from Host
  secrets = config.services.secrets.secrets;
  secrets_list = [
    "piped_restic_env"
    "piped_restic_password"
  ];
in {
  imports = with tree; [
    # needed so can get nginx defaults for proxy
    hosts.hetzner-vm.modules.piped
  ];

  containers.piped = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = hostIP;
    localAddress = containerIP;
    bindMounts = lib.mkMerge (lib.forEach secrets_list (secret_name: let
      path = "${secrets.${secret_name}.path}";
    in {
      "${path}" = {
        hostPath = "${path}";
      };
    }));

    config = {
      config,
      pkgs,
      ...
    }: {
      _module.args = {
        inherit inputs;
        inherit tree;
        host_secrets = secrets;
      };

      imports = with tree;
        [
          profiles.base
          inputs.home-manager-unstable.nixosModules.home-manager
          hosts.hetzner-vm.modules.piped

          profiles.sshd

          modules.nixos.secrets

          users.root
        ]
        ++ (with hosts.hetzner-vm.containers.piped; [
          profiles.piped
          profiles.restic
        ]);

      # For Shared Secrets
      systemd.tmpfiles.rules = [
        "d ${config.services.secrets.secretsDir} - root root"
      ];

      networking.firewall = {
        enable = true;
        allowedTCPPorts = [22] ++ (lib.attrValues ports);
      };

      home-manager.users.root = {
        imports = with tree; [home.base home.dev.small];

        home.stateVersion = "23.05";
      };

      # Manually configure nameserver. Using resolved inside the container seems to fail
      # currently
      environment.etc."resolv.conf".text = "nameserver 8.8.8.8";
      system.stateVersion = "23.05";
    };
  };

  services.nginx.virtualHosts."piped.owo.monster" = {
    forceSSL = true;
    enableACME = true;
    locations."/".root = let
      frontend-package = pkgs.piped-frontend.override {
        backendDomain = "backend.piped.owo.monster";
      };
    in "${frontend-package}/share/piped-frontend";
    extraConfig = ''
      try_files $uri $uri/ /index.html;
    '';
  };

  services.nginx.virtualHosts."backend.piped.owo.monster" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://${containerIP}:${toString ports.piped-backend}";
    };
  };

  services.nginx.virtualHosts."proxy.piped.owo.monster" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://${containerIP}:${toString ports.piped-proxy}";
      extraConfig =
        config.services.piped.proxyNginxExtraConfig
        + ''
          add_header Cache-Control "public, max-age=604800";
        '';
    };
    locations."~ (/videoplayback|/api/v4/|/api/manifest/)" = {
      proxyPass = "http://${containerIP}:${toString ports.piped-proxy}";
      extraConfig =
        config.services.piped.proxyNginxExtraConfig
        + ''
          add_header Cache-Control private always;
        '';
    };
  };

  networking.firewall.allowedTCPPorts = [4242];
}