{config, ...}: let
  serviceName = "excalidraw";
  servicePort = config.m3ta.ports.get serviceName;
in {
  virtualisation.oci-containers.containers."${serviceName}" = {
    image = "docker.io/excalidraw/excalidraw:latest";
    cmd = [
      "/bin/sh"
      "-c"
      ''
        set -e
        if ! grep -q "az-hide-excalidraw-plus" /usr/share/nginx/html/index.html; then
          sed -i 's#</head>#<style id="az-hide-excalidraw-plus">.plus-banner{display:none!important}</style></head>#' /usr/share/nginx/html/index.html
        fi
        exec nginx -g 'daemon off;'
      ''
    ];
    ports = ["127.0.0.1:${toString servicePort}:80"];
    extraOptions = ["--ip=10.89.0.14" "--network=web"];
  };

  services.traefik.dynamicConfigOptions.http = {
    services.${serviceName}.loadBalancer.servers = [{url = "http://localhost:${toString servicePort}/";}];

    routers.${serviceName} = {
      rule = "Host(`draw.l.az-gruppe.com`)";
      tls = {certResolver = "ionos";};
      service = serviceName;
      entrypoints = "websecure";
    };
  };
}