{ inputs, ... }:
{
  containers.music = {
    autoStart = true;
    bindMounts = {
      "/Music" = {
        hostPath = "/mnt/media/Music";
        isReadOnly = false;
      };
    };

    config =
      { config, ... }:
      {
        imports = [ inputs.agenix.nixosModules.default ];

        age = {
          identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
          secrets."tailscale" = {
            file = ../secrets/tailscale.age;
            owner = "tailscale";
          };
        };

        services = {
          navidrome = {
            enable = true;
            settings = {
              MusicFolder = "/Music";
              port = 4533;
            };
          };

          tailscale = {
            enable = true;
            useRoutingFeatures = "server";
            interfaceName = "userspace-networking";
            authKeyFile = config.age.secrets.tailscale.path;
          };
        };

        system.stateVersion = "24.05";
      };
  };
}