{ config, ... }:
{
  sops.defaultSopsFile = ../../secrets/bucur.yaml;
  sops.age.keyFile = "/var/lib/sops/age/keys.txt";

  systemd.tmpfiles.rules = [
    "d /var/lib/sops/age 0700 root root -"
  ];

  sops.secrets.mtproto_secret = {};

  sops.templates."mtproto-proxy.env".content = ''
SECRET=${config.sops.placeholder."mtproto_secret"}
'';

  virtualisation.podman.enable = true;
  virtualisation.oci-containers.backend = "podman";

  virtualisation.oci-containers.containers = {
    portainer = {
      image = "docker.io/portainer/portainer-ce:lts";
      autoStart = true;
      ports = [
        "100.124.109.92:8000:8000"
        "100.124.109.92:9443:9443"
      ];
      volumes = [
        "portainer_data:/data"
        "/run/podman/podman.sock:/var/run/docker.sock"
      ];
      extraOptions = [ "--privileged" ];
    };

    mtproto-proxy = {
      image = "docker.io/telegrammessenger/proxy:latest";
      autoStart = true;
      ports = [ "0.0.0.0:8443:443" ];
      volumes = [ "mtproxy-data:/data" ];
      environmentFiles = [ config.sops.templates."mtproto-proxy.env".path ];
    };
  };
}