{
  config,
  pkgs,
  ...
}: let
  serviceName = "online3dviewer";
  servicePort = config.m3ta.ports.get serviceName;
in {
  virtualisation.oci-containers.containers."${serviceName}" = {
    image = "docker.io/nginxinc/nginx-unprivileged:stable-alpine";
    ports = ["127.0.0.1:${toString servicePort}:8080"];
    volumes = ["${pkgs.online3dviewer}:/usr/share/nginx/html:ro"];
    extraOptions = [
      "--ip=10.89.0.15"
      "--network=web"
      "--security-opt=no-new-privileges"
      "--cap-drop=ALL"
    ];
  };

  services.traefik.dynamicConfigOptions.http = {
    services.${serviceName}.loadBalancer.servers = [{url = "http://localhost:${toString servicePort}/";}];

    routers.${serviceName} = {
      rule = "Host(`3dv.l.az-gruppe.com`)";
      tls = {certResolver = "ionos";};
      service = serviceName;
      entrypoints = "websecure";
    };
  };
}