{ lib, ... }:

{
  services.miniflux = {
    enable = true;
    config = {
      BASE_URL = "http://mf.elmo.mou.fo";
      CREATE_ADMIN = 0;
      LISTEN_ADDR = "/run/miniflux/miniflux.sock";
    };
  };

  # https://github.com/NixOS/nixpkgs/issues/177284
  systemd.services.miniflux.serviceConfig.RuntimeDirectoryMode = lib.mkForce "0755";

  # TODO allocate a subdomain
  services.nginx.virtualHosts."mf.elmo.mou.fo" = {
    # TODO enableACME = true;
    # TODO forceSSL = true;
    locations."/" = {
      proxyPass = "http://unix:/run/miniflux/miniflux.sock";
    };
  };

  # TODO services.oauth2-proxy.nginx.virtualHosts = { "mf.mou.fo" = {}; };

  virtualisation.podman.enable = true;
  virtualisation.oci-containers = {
    containers = {
      rss = {
        image = "codeberg.org/danb/rss";
        ports = [ "127.0.0.1:8283:80" ];
        volumes = [ "/home/joe/rss:/app/storage" ];
        autoStart = true;
      };
    };
  };

  services.nginx.virtualHosts."rss.elmo.mou.fo" = {
    locations."/" = {
      proxyPass = "http://localhost:8283";
    };
  };
}