{
  config,
  inputs,
  outputs,
  ...
}:
{
  containers = {
    grist-latest = {
      autoStart = false;
      privateNetwork = true;
      hostAddress = "192.168.1.1";
      localAddress = "192.168.1.2";
      specialArgs = { inherit outputs; };
      config = import ./grist.nix;
    };

    grasp = {
      autoStart = false;
      privateNetwork = true;
      hostAddress = "192.168.1.1";
      localAddress = "192.168.1.4";
      specialArgs = { inherit outputs inputs; };

      bindMounts = {
        "/run/secrets/grasp-owner" = {
          hostPath = config.age.secrets."odin/services/grasp-owner".path;
          isReadOnly = true;
        };
      };

      config = import ./grasp.nix;
    };

    gogs = {
      autoStart = false;
      privateNetwork = true;
      hostAddress = "192.168.1.1";
      localAddress = "192.168.1.3";
      specialArgs = { inherit outputs; };

      bindMounts = {
        "/run/secrets/gogs-admin" = {
          hostPath = config.age.secrets."odin/services/gogs-admin".path;
          isReadOnly = true;
        };
      };

      config = import ./gogs.nix;
    };
  };

  services.caddy.virtualHosts.grist = {
    hostName = "grist.{$DOMAIN}";
    extraConfig = ''
      encode gzip zstd
      reverse_proxy 192.168.1.2:8484
    '';
  };
}