{ config, ... }:
{
  networking.firewall.allowedTCPPorts = [ 1965 ];

  virtualisation.oci-containers.containers.locus = {
    inherit (config.modules.containers) extraOptions;

    image = "ghcr.io/gemrest/locus";
    autoStart = true;
    ports = [ "1965:1965" ];
    volumes = [ "/mnt/docker/locus:/locus/.locus" ];
    environment.HEADER_IMAGE = "https://ruu.neocities.org/images/animeHeader.gif";
    environmentFiles = [ config.sops.secrets.finnhub_token.path ];

    login = {
      registry = "ghcr.io";
      username = config.sops.secrets."ghcr/user".path;
      passwordFile = config.sops.secrets."ghcr/password".path;
    };
  };
}