{
  outputs,
  inputs,
  ...
}:
{
  imports = [
    outputs.modules.global.nix-config
    "${inputs.ngit-grasp}/nix/module.nix"
  ];

  services.ngit-grasp.primary = {
    enable = true;
    domain = "grasp.t5.st";
    port = 7334;
    bindAddress = "0.0.0.0";
    dataDir = "/var/lib/ngit-grasp";
    relayOwnerNsecFile = "/run/secrets/grasp-owner";
    metricsEnabled = false;
    archiveWhitelist = [
      "npub1z0fle6nzrw3c6mv7klxyhkycpkt7lna04p9z5e4yq5rss259dq0sky7xzd"
      "npub1k0y4eceal2zryes3azm6nsgt0r0jsa2v8zcsdf9uqxttn0jlfe9q04c9h8"
    ];
  };

  networking = {
    firewall.allowedTCPPorts = [ 7334 ];
    interfaces.eth0 = {
      ipv4.addresses = [
        {
          address = "192.168.1.4";
          prefixLength = 24;
        }
      ];
    };
    defaultGateway = "192.168.1.1";
    nameservers = [ "8.8.8.8" ];
    useDHCP = false;
  };

  boot.isContainer = true;
  system.stateVersion = "26.05";
}