{config, ...}: let
  serviceName = "stirling-pdf";
  servicePort = config.m3ta.ports.get serviceName;
in {
  virtualisation.oci-containers.containers."${serviceName}" = {
    image = "docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest-fat";
    ports = ["127.0.0.1:${toString servicePort}:8080"];
    environment = {
      SECURITY_ENABLELOGIN = "False";
      DISABLE_ADDITIONAL_FEATURES = "False";
    };

    volumes = [
      "stirling_pdf_data:/usr/share/tessdata"
      "stirling_pdf_configs:/configs"
    ];
    extraOptions = ["--ip=10.89.0.13" "--network=web"];
  };

  services.traefik.dynamicConfigOptions.http = {
    services.${serviceName}.loadBalancer.servers = [{url = "http://localhost:${toString servicePort}/";}];

    routers.${serviceName} = {
      rule = "Host(`pdf.l.az-gruppe.com`)";
      tls = {certResolver = "ionos";};
      service = serviceName;
      entrypoints = "websecure";
    };
  };
}