{ config, secrets, ... }:
{
  sops.secrets.efl-tuwunel-env = {
    sopsFile = secrets.efl-tuwunel;
    restartUnits = [ "podman-tuwunel.service" ];
    format = "dotenv";
  };
  virtualisation.oci-containers.containers = {
    tuwunel = {
      image = "ghcr.io/matrix-construct/tuwunel:latest";
      volumes = [
        "tuwunel_db:/var/lib/tuwunel"
      ];
      ports = [ "6167:6167" ];
      networks = [ "podman" ];
      extraOptions = [ "--pids-limit=-1" ];
      environment = {
        TUWUNEL_SERVER_NAME = "mtx.eflx.top";
        TUWUNEL_PORT = "6167";
        TUWUNEL_ADDRESS = "0.0.0.0";
        TUWUNEL_WELL_KNOWN__SERVER = "mtx.eflx.top:443";
        TUWUNEL_WELL_KNOWN__CLIENT = "https://mtx.eflx.top";
      };
      environmentFiles = [
        config.sops.secrets.efl-tuwunel-env.path
      ];
    };

    send = {
      image = "lanol/filecodebox:latest";
      ports = [ "12345:12345" ];
      volumes = [ "/var/lib/send:/app/data:rw" ];
    };
  };
  services.caddy.virtualHosts."mtx.eflx.top" = {
    extraConfig = ''
      reverse_proxy :6167
    '';
  };
  services.caddy.virtualHosts."send.eflx.top" = {
    extraConfig = ''
      reverse_proxy :12345
    '';
  };
  my.services.frp.webServers = [
    "mtx.eflx.top"
    "send.eflx.top"
  ];
}