{
  pkgs,
  config,
  ...
}: let
  containerStateDir = "/data";
  hostStateDir = "/opt/tangd";
  domain = "";
  serviceAddress = "10.10.42.12";
in {
  services.nginx.virtualHosts."${domain}" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://${serviceAddress}:${toString servicePort}";
    };
  };

  containers."tang" = {
    autoStart = true;
    ephemeral = true;
    bindMounts."${containerStateDir}" = {
      hostPath = hostStateDir;
      isReadOnly = false;
    };

    config = {
      config,
      pkgs,
      ...
    }: {
      networking.firewall.enable = false;

      users.groups."_tang" = {};

      users.users."_tang" = {
        group = "_tang";
        isSystemUser = true;
      };

      environment.systemPackages = ["${pkgs.jose}"];

      systemd.services."tangd@" = {
        enable = true;
        serviceConfig = {
          ExecStartPre = "${pkgs.bash}/bin/bash -c \"mkdir -p ${containerStateDir}/tang-db\"";
          ExecStart = "${pkgs.tang}/libexec/tangd ${containerStateDir}/tang-db";
          StandardInput = "socket";
          StandardOutput = "socket";
          StandardError = "journal";
          User = "_tang";
          Group = "_tang";
        };
      };

      systemd.sockets."tangd" = {
        enable = true;
        listenStreams = ["${toString servicePort}"];
        wantedBy = ["sockets.target"];
        socketConfig = {
          Accept = true;
        };
      };

      system.stateVersion = "22.11";
    };
  };
}