{ config, pkgs, inputs, ... }: {
	# Secrets
	sops.secrets.embedtube-api-key = { sopsFile = ./resources/secrets/embedtube.yaml; key = "api-key"; };

	# Container
	containers.embedtube = {
		autoStart = true;
		privateNetwork = true;
		ephemeral = true;
		hostBridge = "br-lan1";
		localMacAddress = "02:00:00:00:77:14";

		bindMounts."/run/secrets/api-key" = {
			hostPath = config.sops.secrets.embedtube-api-key.path;
			isReadOnly = true;
		};

		config = { lib, pkg, config, ... }: {
			# Import EmbedTube flake input
			imports = [ inputs.embedtube.nixosModules.default ];

			# Network
			networking.interfaces.eth0.useDHCP = true;
			networking.firewall.allowedTCPPorts = [ 80 ];  # Caddy (private + public)

			# EmbedTube
			services.embedtube = {
				enable = true;
				apiKeyFile = "/run/secrets/api-key";
			};

			# Reverse proxy
			services.caddy = {
				enable = true;
				virtualHosts.":80".extraConfig = ''
					reverse_proxy localhost:8080
				'';
			};

			system.stateVersion = "26.05";
		};
	};
}