{
  hostAddress,
  localAddress,
  httpPort ? 80,
  httpsPort ? 443,
  autoStart ? false,
}: let
  passwords = import ../../variables/passwords.crypt.nix;
in {
  config = {
    config,
    pkgs,
    lib,
    ...
  }: {
    system.stateVersion = "22.05"; # Did you read the comment?

    imports = [../profiles/containers/configuration.nix];

    networking.firewall.enable = false;

    services.ddclientovh = {
      enable = true;
      domain = "www.stefanjunker.de";
    };

    security.acme = {
      acceptTerms = true;
      certs."www.stefanjunker.de".email = "mail@stefanjunker.de";
      preliminarySelfsigned = true;

      # can be used for debugging
      # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
    };

    services.nginx.enable = true;
    services.nginx.recommendedProxySettings = true;
    services.nginx.virtualHosts."www.stefanjunker.de" = {
      default = true;
      addSSL = true;
      listen = [
        {
          addr = "0.0.0.0";
          port = httpPort;
          ssl = false;
        }
        {
          addr = "0.0.0.0";
          port = httpsPort;
          ssl = true;
        }
      ];

      root = "/var/www/stefanjunker.de/htdocs";

      enableACME = true;

      locations."/hedgedoc/" = {proxyPass = "http://[::1]:3000/";};

      locations."/hedgedoc/socket.io/" = {
        proxyPass = "http://[::1]:3000/socket.io/";
        proxyWebsockets = true;
      };
    };

    services.hedgedoc = {
      enable = true;
      settings = {
        domain = "www.stefanjunker.de";
        urlPath = "hedgedoc";
        protocolUseSSL = true;
        db = {
          dialect = "sqlite";
          storage = "/var/lib/hedgedoc/db.hedgedoc.sqlite";
        };

        allowAnonymous = false;
        allowAnonymousEdits = false;
        allowGravatar = false;
        allowFreeURL = false;
        defaultPermission = "private";
        allowEmailRegister = false;

        # oauth2 provider config
        inherit (passwords.www_stefanjunker_de_hedgedoc) dropbox;

        uploadsPath = "/var/lib/hedgedoc/uploads";
      };
    };
  };

  inherit autoStart;

  bindMounts = {
    "/etc/secrets/" = {
      hostPath = "/var/lib/container-volumes/webserver/etc-secrets";
      isReadOnly = true;
    };

    "/var/www" = {
      hostPath = "/var/lib/container-volumes/webserver/var-www";
      isReadOnly = false;
    };

    "/var/lib/mysql" = {
      hostPath = "/var/lib/container-volumes/webserver/var-lib-mysql";
      isReadOnly = false;
    };

    "/var/lib/hedgedoc" = {
      hostPath = "/var/lib/container-volumes/webserver/var-lib-hedgedoc";
      isReadOnly = false;
    };
  };

  extraFlags = ["--resolv-conf=bind-host"];

  privateNetwork = true;
  forwardPorts = [
    {
      # http
      containerPort = 80;
      hostPort = httpPort;
      protocol = "tcp";
    }
    {
      # https
      containerPort = 443;
      hostPort = httpsPort;
      protocol = "tcp";
    }
  ];

  inherit hostAddress localAddress;
}