{...}: {
  # Collabora Code server
  virtualisation.oci-containers.containers."nextcloud-collabora-code" = {
    image = "collabora/code";
    autoStart = true;
    ports = ["127.0.0.1:9980:9980"];
    environment.domain = "data\\.gssws\\.de";
    extraOptions = ["--cap-add" "MKNOD"];
  };

  services.nginx.virtualHosts."office.gssws.de" = let
    proxyPass = "https://127.0.0.1:9980";
    extraConfig = "proxy_ssl_verify off;";
  in {
    enableACME = true;
    forceSSL = true;

    locations."^~ /browser" = {
      inherit proxyPass extraConfig;
    };
    locations."^~ /hosting/discovery" = {
      inherit proxyPass extraConfig;
    };
    locations."^~ /hosting/capabilities" = {
      inherit proxyPass extraConfig;
    };
    locations."~ ^/cool/(.*)/ws''$" = {
      inherit proxyPass extraConfig;
      proxyWebsockets = true;
    };
    locations."~ ^/(c|l)ool" = {
      inherit proxyPass extraConfig;
    };
    locations."^~ /cool/adminws" = {
      inherit proxyPass extraConfig;
      proxyWebsockets = true;
    };
  };
}