{ config, containerCfg, pkgs, lib, builder, name,... }:
let 
  serverCfg = config.syscfg.server;
  
  # Umami image built from nixpkgs
  image = pkgs.dockerTools.streamLayeredImage {
    name = pkgs.umami.name;
    tag = pkgs.umami.version;
    contents = with pkgs; [ cacert openssl ];
    config = {
      # Umami in nixpkgs typically provides a binary or script to start the server
      Entrypoint = [ "${pkgs.umami}/bin/umami-server" ];
      ExposedPorts = { "3000/tcp" = {}; };
      Env = [ "NODE_ENV=production" ];
    };
  };
in {
  requires = {
    secrets = [ name ];
    databases = [ name ];
  };

  runtime = {
    paths = [{
      path = "${serverCfg.path.config.path}/umami/";
      mode = "0444";
    }];

    containers = {
      server = builder.mkContainer {
        authentik = true;
        tmpfs = true;
        subdomain = containerCfg.subdomain;
        image = "${pkgs.umami.name}:${pkgs.umami.version}"; 
        imageStream = image;
        port = 3000;
        secret = name;
        extraEnv = {
          PORT = "3000";
          # HOSTNAME = "${containerCfg.subdomain}.${serverCfg.domain}";
          DATABASE_TYPE = "postgresql";
          REDIS_URL = "redis://${builder.host}";
          CLIENT_IP_HEADER = "X-Forwarded-For";
          BASE_PATH = lib.optionalString (containerCfg.subpath or null != null) "/${containerCfg.subpath}";
          # DISABLE_LOGIN = "1";#(if serverCfg.containers?authentik then "1" else "0");

        };
        overrides = {
          cmd = [ "start" ]; # Specific command for the umami binary
         };
      };
    };
  };
}
