{ config, containerCfg, pkgs, lib, builder, name,... }:
let 
  serverCfg = config.syscfg.server;
  image = pkgs.dockerTools.streamLayeredImage {
    name = "traefik";
    tag = pkgs.traefik.version;
    contents = with pkgs;[ cacert tzdata ];
    config = {
      Entrypoint = [ "${pkgs.traefik}/bin/traefik" ];
      WorkingDir = "/";
    };
  };
in {
  requires.secrets = [ name ];

  runtime = {

    containers = {
      server = builder.mkContainer {
        imageStream = image;
        subdomain = containerCfg.subdomain;
        port = 8080;
        secret = name;
        extraLabels = {
          "traefik.http.routers.${containerCfg.subdomain}.priority" = "10";
          "traefik.http.routers.${containerCfg.subdomain}.service" = "api@internal";


          "traefik.http.middlewares.hsts-headers.headers.stsSeconds" = "15552000";
          "traefik.http.middlewares.hsts-headers.headers.stsIncludeSubdomains" = "true";
          "traefik.http.middlewares.hsts-headers.headers.stsPreload" = "true";
          "traefik.http.middlewares.hsts-headers.headers.forceSTSHeader" = "true";
                  
          "traefik.http.routers.${containerCfg.subdomain}.middlewares" =  if serverCfg.containers?authentik then "authentik" else "";
        } // (if serverCfg.containers?authentik then {
          "traefik.http.middlewares.authentik.forwardauth.maxResponseBodySize" = "10485760";
          "traefik.http.middlewares.authentik.forwardauth.address" = "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik";
          "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader" = "true";
          "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders" = "X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version";
        } else {}) // (if serverCfg.containers?umami then {
          "traefik.http.middlewares.umami-global.plugin.umami-feeder.umamiHost" = "http://umami-server:3000";
          "traefik.http.middlewares.umami-global.plugin.umami-feeder.umamiUsername" = "admin";
          "traefik.http.middlewares.umami-global.plugin.umami-feeder.umamiPassword" = "umami";
          "traefik.http.middlewares.umami-global.plugin.umami-feeder.createNewWebsites" = "true";
        } else {}) // (if containerCfg.extra ? provider || serverCfg.domain != "localhost" then {
          "traefik.http.routers.${containerCfg.subdomain}.tls.certresolver" = "default";
          "traefik.http.routers.${containerCfg.subdomain}.tls.domains[0].main" = "${serverCfg.domain}";
          "traefik.http.routers.${containerCfg.subdomain}.tls.domains[0].sans" = "*.${serverCfg.domain}";
        } else {});
        extraEnv = { };
        overrides = {
          cmd = [ 
            "--api"
            "--log.level=INFO"
            "--providers.docker=true"
            "--global.checknewversion=false"
            "--global.sendanonymoususage=false"
            "--api.insecure=true"
            "--api.dashboard=true"
            "--providers.docker.exposedByDefault=false"
            "--entrypoints.web.address=:80"
            "--entrypoints.web-secure.address=:443"
            "--entrypoints.web.http.redirections.entrypoint.to=web-secure"
            "--entrypoints.web.http.redirections.entrypoint.scheme=https"
            "--entrypoints.web-secure.transport.respondingtimeouts.readtimeout=0s"
            "--entrypoints.web-secure.proxyprotocol.trustedips=127.0.0.1/32,192.168.1.1/16,10.10.0.0/16"
          ] ++ (if serverCfg.containers ? umami  then [
            "--experimental.plugins.umami-feeder.moduleName=github.com/astappiev/traefik-umami-feeder"
            "--experimental.plugins.umami-feeder.version=v1.4.1"
            "--entrypoints.web-secure.http.middlewares=umami-global@docker"
          ] else []) ++ (if containerCfg.extra ? provider then [
            "--certificatesresolvers.default.acme.email=acme@${serverCfg.domain}"
            "--certificatesresolvers.default.acme.dnschallenge=true"
            "--certificatesresolvers.default.acme.dnschallenge.provider=${containerCfg.extra.provider}"
            "--certificatesresolvers.default.acme.storage=/acme.json"
          ] else if serverCfg.domain != "localhost" then [
            "--certificatesresolvers.default.acme.httpchallenge=false"
            "--certificatesresolvers.default.acme.tlschallenge=true"
          ] else []);
          ports = [ "443:443" "80:80" ] ++ (if containerCfg.port!=null then [ "${toString containerCfg.port}:8080" ] else []);
          volumes = [
            "/var/run/podman/podman.sock:/var/run/docker.sock"
          ];
        };
      };
    };
  };
}
