{
  pkgs,
  config,
  ...
}: let
  serviceAddress = "10.10.41.11";
  containerStateDir = "/data";
  hostStateDir = "/srv/container/lrad";
in {
  containers."lrad" = {
    privateNetwork = true;
    hostAddress = "10.10.41.1";
    localAddress = serviceAddress;

    bindMounts."${containerStateDir}" = {
      hostPath = hostStateDir;
      isReadOnly = false;
    };

    config = {
      config,
      pkgs,
      ...
    }: {
      networking.firewall.allowedTCPPorts = [63080];

      #users.users."tang".isSystemUser = true;

      systemd.services."tangd" = {
        enable = true;
        # TODO: require data/tangd to exist
        serviceConfig = {
          ExecStart = "${pkgs.tang}/bin/tangd ${containerStateDir}/data/tangd";
          StandardInput = "socket";
          StandardOutput = "socket";
          StandardError = "journal";
          User = "tang";
        };
      };

      systemd.sockets."tangd" = {
        enable = true;
        listenStreams = ["63080"];
        wantedBy = ["sockets.target"];
        socketConfig = {
          Accept = true;
        };
      };
    };
  };
}