{ config, common, ... }:
let
  domain = "beta.budget.${common.domain}";
  port = 8084;
in
{
  networking.nat = {
    enable = false;
    internalInterfaces = [ "ve-*" ];
    externalInterface = "wlan0";
    # Lazy IPv6 connectivity for the container
    enableIPv6 = true;
  };

  containers.actual = {
    autoStart = false;
    privateNetwork = true;
    hostAddress = "192.168.10.188";
    localAddress = "192.168.10.11";
    config =
      { ... }:
      {
        networking.firewall.allowedTCPPorts = [ port ];
        services = {
          actual = {
            enable = false;
            settings = {
              inherit port;
              loginMethod = "password";
            };
          };
        };
        system.stateVersion = common.system.version;
      };
  };
  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://${config.containers.actual.localAddress}:${toString port}";
      proxyWebsockets = true;
    };
  };
}
