{
  config,
  pkgs,
  lib,
  ...
}: let
  domain = "push.${config.customOps.domain.fqdn}";
  connectPort = 8082;
  endpointPort = 8080;
in {
  sops.secrets = {
    "autopush/autoconnect" = {};
    "autopush/autoendpoint" = {};
  };

  virtualisation.oci-containers.containers."autopush-autoconnect" = {
    image = "compose2nix/autopush-autoconnect";
    environment = {
      "AUTOCONNECT__DB_DSN" = "redis://redis";
      "AUTOCONNECT__ENDPOINT_HOSTNAME" = "updates.${domain}";
      "AUTOCONNECT__ENDPOINT_PORT" = "443";
      "AUTOCONNECT__ENDPOINT_SCHEME" = "https";
      "AUTOCONNECT__ROUTER_HOSTNAME" = "autoconnect";
    };
    environmentFiles = [
      config.sops.secrets."autopush/autoconnect".path
    ];
    ports = [
      "8080:8080/tcp"
    ];
    dependsOn = [
      "autopush-redis"
    ];
    log-driver = "journald";
    extraOptions = [
      "--network-alias=autoconnect"
      "--network=autopush_default"
    ];
  };

  systemd.services."docker-autopush-autoconnect" = {
    serviceConfig = {
      Restart = lib.mkOverride 90 "always";
      RestartMaxDelaySec = lib.mkOverride 90 "1m";
      RestartSec = lib.mkOverride 90 "100ms";
      RestartSteps = lib.mkOverride 90 9;
    };
    after = [
      "docker-network-autopush_default.service"
    ];
    requires = [
      "docker-network-autopush_default.service"
    ];
    partOf = [
      "docker-compose-autopush-root.target"
    ];
    wantedBy = [
      "docker-compose-autopush-root.target"
    ];
  };

  virtualisation.oci-containers.containers."autopush-autoend" = {
    image = "compose2nix/autopush-autoend";
    environment = {
      "AUTOEND__DB_DSN" = "redis://redis";
      "AUTOEND__ENDPOINT_URL" = "https://updates.${domain}";
      "AUTOEND__HOST" = "0.0.0.0";
      "AUTOEND__PORT" = "8082";
    };
    environmentFiles = [
      config.sops.secrets."autopush/autoendpoint".path
    ];

    ports = [
      "8082:8082/tcp"
    ];
    dependsOn = [
      "autopush-autoconnect"
      "autopush-redis"
    ];
    log-driver = "journald";
    extraOptions = [
      "--network-alias=autoendpoint"
      "--network=autopush_default"
    ];
  };

  systemd.services."docker-autopush-autoend" = {
    serviceConfig = {
      Restart = lib.mkOverride 90 "always";
      RestartMaxDelaySec = lib.mkOverride 90 "1m";
      RestartSec = lib.mkOverride 90 "100ms";
      RestartSteps = lib.mkOverride 90 9;
    };
    after = [
      "docker-network-autopush_default.service"
    ];
    requires = [
      "docker-network-autopush_default.service"
    ];
    partOf = [
      "docker-compose-autopush-root.target"
    ];
    wantedBy = [
      "docker-compose-autopush-root.target"
    ];
  };

  virtualisation.oci-containers.containers."autopush-redis" = {
    image = "redis:latest";
    cmd = ["redis-server"];
    log-driver = "journald";
    extraOptions = [
      "--network-alias=redis"
      "--network=autopush_default"
    ];
  };

  systemd.services."docker-autopush-redis" = {
    serviceConfig = {
      Restart = lib.mkOverride 90 "always";
      RestartMaxDelaySec = lib.mkOverride 90 "1m";
      RestartSec = lib.mkOverride 90 "100ms";
      RestartSteps = lib.mkOverride 90 9;
    };
    after = [
      "docker-network-autopush_default.service"
    ];
    requires = [
      "docker-network-autopush_default.service"
    ];
    partOf = [
      "docker-compose-autopush-root.target"
    ];
    wantedBy = [
      "docker-compose-autopush-root.target"
    ];
  };

  systemd.services."docker-network-autopush_default" = {
    path = [pkgs.docker];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStop = "docker network rm -f autopush_default";
    };
    script = ''
      docker network inspect autopush_default || docker network create autopush_default
    '';
    partOf = ["docker-compose-autopush-root.target"];
    wantedBy = ["docker-compose-autopush-root.target"];
  };

  systemd.services."docker-build-autopush-autoconnect" = {
    path = [pkgs.docker pkgs.git];
    serviceConfig = {
      Type = "oneshot";
      TimeoutSec = 300;
    };
    script = ''
      docker build -t compose2nix/autopush-autoconnect --build-arg BINARY=autoconnect --build-arg BUILD_ARGS=--no-default-features --features redis --build-arg CRATE=autoconnect https://github.com/mozilla-services/autopush-rs.git
    '';
  };

  systemd.services."docker-build-autopush-autoend" = {
    path = [pkgs.docker pkgs.git];
    serviceConfig = {
      Type = "oneshot";
      TimeoutSec = 300;
    };
    script = ''
      docker build -t compose2nix/autopush-autoend --build-arg BUILD_ARGS=--no-default-features --features redis --build-arg CRATE=autoendpoint --build-arg BINARY=autoendpoint https://github.com/mozilla-services/autopush-rs.git
    '';
  };

  systemd.targets."docker-compose-autopush-root" = {
    unitConfig = {
      Description = "Root target generated by compose2nix.";
    };
    wantedBy = ["multi-user.target"];
  };

  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
    enableACME = true;
    locations."/".proxyPass = "http://127.0.0.1:${builtins.toString endpointPort}";
  };

  services.nginx.virtualHosts."updates.${domain}" = {
    forceSSL = true;
    enableACME = true;
    locations."/".proxyPass = "http://127.0.0.1:${builtins.toString connectPort}";
  };
}