{ config, pkgs, ... }:
{
  containers.ttrss = {
    config = {
      users.users.ttrss = {
        group = "ttrss";
        isSystemUser = true;
      };
      users.groups.ttrss = {};

      users.users.tt_rss.isSystemUser = true;

      services.postgresql = {
        enable = true;
        package = pkgs.postgresql95;
        initialScript = pkgs.writeText "ttrss-init.sql" ''
          create database ttrss;
          create user ttrss with password 'ttrss';
          grant all privileges on database ttrss to ttrss;
        '';
      };

      services.tt-rss = {
        enable = true;
        user = "ttrss";

        pool = "ttrss";
        virtualHost = null;

        database = {
          type = "pgsql";
          host = "localhost";
          name = "ttrss";
          user = "ttrss";
          password = "ttrss";
        };

        selfUrlPath = "https://reader.gebner.org/";
      };

      services.phpfpm = {
        pools = {
          ttrss = {
            user = "ttrss";
            group = "ttrss";
            settings = {
              listen = "9000";
              pm = "dynamic";
              "pm.max_children" = 75;
              "pm.start_servers" = 10;
              "pm.min_spare_servers" = 5;
              "pm.max_spare_servers" = 20;
              "pm.max_requests" = 500;
              catch_workers_output = 1;
            };
          };
        };
      };

      networking.firewall.allowedTCPPorts = [ 9000 ];
    };

    autoStart = true;
    hostAddress = "192.168.100.10";
    localAddress = "192.168.100.11";
    privateNetwork = true;
  };

  networking.nat.enable = true;
  networking.nat.internalInterfaces = ["ve-+"];
  networking.nat.externalInterface = "ens3";

  security.acme.certs."gebner.org".extraDomainNames = [ "reader.gebner.org" ];

  services.nginx = {
    virtualHosts."reader.gebner.org" = {
      forceSSL = true;
      useACMEHost = "gebner.org";
      locations."/" = {
        root = "/var/lib/containers/ttrss/var/lib/tt-rss";
        index = "index.php";
      };
      locations."/cache".extraConfig = "deny all;";
      locations."= /config.php".extraConfig = "deny all;";
      locations."~ \\.php$".extraConfig = ''
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass 192.168.100.11:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME /var/lib/tt-rss/$fastcgi_script_name;
        include ${pkgs.nginx}/conf/fastcgi_params;
      '';
    };
  };

}