{ hostAddress
, localAddress
, httpsPort ? 443
}: {
  config = { config, pkgs, lib, ... }: {
    imports = [
      ../profiles/containers/configuration.nix
    ];

    networking.firewall.enable = false;

    services.ddclientovh = {
        enable = true;
        domain = "www.stefanjunker.de";
    };

    security.acme = {
      acceptTerms = true;
      certs."www.stefanjunker.de".email = "mail@stefanjunker.de";
    };

    services.nginx.enable = true;
    services.nginx.virtualHosts."www.stefanjunker.de" = {
      default = true;
      onlySSL = true;
      root = "/var/www/stefanjunker.de/htdocs";

      enableACME = true;
      serverAliases = [
        "stefanjunker.de"
      ];
      # sslCertificate = "/etc/secrets/stefanjunker.de/nginx/nginx.crt";
      # sslCertificateKey = "/etc/secrets/stefanjunker.de/nginx/nginx.key";

      locations."/fi" = {
        index = "index.php";
      };

      locations."~ ^(.+\.php)(.*)$".extraConfig = ''
        fastcgi_split_path_info  ^(.+\.php)(.*)$;

        fastcgi_pass unix:${config.services.phpfpm.pools.mypool.socket};
        fastcgi_index index.php;
      '';
    };

    services.phpfpm.pools.mypool = {
      user = "nobody";
      phpPackage = pkgs.php5;
      settings = {
        "listen.owner" = config.services.nginx.user;
        "pm" = "dynamic";
        "pm.max_children" = 5;
        "pm.start_servers" = 2;
        "pm.min_spare_servers" = 1;
        "pm.max_spare_servers" = 3;
        "pm.max_requests" = 500;

        "php_admin_value[error_reporting]" = "E_ALL & ~E_NOTICE & ~E_WARNING & ~E_STRICT & ~E_DEPRECATED";
      };
    };

    # the custom php5 we're using here has no fpm-systemd, so the default `Type = "notify"` won't work
    systemd.services."phpfpm-mypool" = {
      serviceConfig = {
        Type = lib.mkForce "simple";
      };
    };

    services.mysql = {
      enable = true;
      package = pkgs.mariadb;
    };
  };

  autoStart = true;

  bindMounts = {
    "/etc/secrets/" = {
      hostPath = "/var/lib/container-volumes/webserver/etc-secrets";
      isReadOnly = true;
    };

    "/var/www" = {
      hostPath = "/var/lib/container-volumes/webserver/var-www";
      isReadOnly = false;
    };

    "/var/lib/mysql" = {
      hostPath = "/var/lib/container-volumes/webserver/var-lib-mysql";
      isReadOnly = false;
    };
  };

  privateNetwork = true;
  forwardPorts = [
    {
      # https
      containerPort = 443;
      hostPort = httpsPort;
      protocol = "tcp";
    }
  ];

  inherit hostAddress localAddress;
}