{
  config,
  pkgs,
  ...
}: let
  domain = "t.gssws.de";
  servicePort = 63080;
in {
  services.nginx.virtualHosts."${domain}" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:${builtins.toString servicePort}";
    };
  };

  virtualisation.oci-containers.containers."tang" = {
    image = "cloggo/tangd";
    ports = ["127.0.0.1:${builtins.toString servicePort}:8080"];
    environment = {
      IP_WHITELIST = "172.17.0.1";
    };
  };
}