{ unstable-pkgs, ... }:
{
  users.users.cerulea-video = {
    isSystemUser = true;
    group = "cerulea-video";
    home = "/srv/apps/cerulea-video";
    createHome = false;
  };
  users.groups.cerulea-video = { };

  systemd.services.cerulea-video = {
    description = "cerulea video";
    after = [ "network.target" ];
    wantedBy = [ "multi-user.target" ];

    serviceConfig = {
      Type = "simple";
      User = "cerulea-video";
      Group = "cerulea-video";
      WorkingDirectory = "/srv/apps/cerulea-video";
      ExecStartPre = "${unstable-pkgs.deno}/bin/deno task client:build";
      ExecStart = "${unstable-pkgs.deno}/bin/deno serve -A --host 127.0.0.16 --port 4080 ./appview/main.ts";
      Restart = "on-failure";
      RestartSec = "5s";

      NoNewPrivileges = true;
      PrivateTmp = true;
      ProtectSystem = "strict";
      ProtectHome = "read-only";
      ReadWritePaths = [ "/srv/apps/cerulea-video" ];
    };
  };

  services.nginx.virtualHosts."video.cerulea.blue" = {
    forceSSL = true;
    enableACME = true;

    locations."/" = {
      proxyPass = "http://127.0.0.16:4080";
      proxyWebsockets = true;
      extraConfig = ''
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      '';
    };
  };
}