{
  den,
  __findFile,
  modules,
  ...
}: {
  modules.services.provides.rtmp-to-whip = {
    nixos = {
      config,
      pkgs,
      ...
    }: {
      systemd.services.init-rtmp-to-whip-network = {
        description = "Create rtmp-to-whip docker network";
        after = [ "docker.service" "docker.socket" ];
        requires = [ "docker.service" "docker.socket" ];
        before = [ "docker-rtmp-to-whip.service" "docker-rtmp-to-whip-frontend.service" ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = true;
        };
        script = ''
          ${pkgs.docker}/bin/docker network inspect rtmp-to-whip >/dev/null 2>&1 || \
          ${pkgs.docker}/bin/docker network create rtmp-to-whip
        '';
      };

      virtualisation.oci-containers.containers = {
        rtmp-to-whip = {
          image = "reg.h.doloro.co.uk/doloro/rtmp-to-whip:latest";
          ports = [
            "0.0.0.0:1935:1935"     # RTMP ingestion
            "0.0.0.0:6969:6969/udp" # WebRTC UDP
          ];
          environment = {
            PUBLIC_DOMAIN = "rtmp.h.doloro.co.uk";
            RTC_PORT = "6969";
            SIGNUP_CODE = "";
          };
          volumes = [
            "/data/rtmp-to-whip/db.sqlite:/app/db.sqlite"
          ];
          extraOptions = [ "--network=rtmp-to-whip" ];
        };

        rtmp-to-whip-frontend = {
          image = "reg.h.doloro.co.uk/doloro/rtmp-to-whip-frontend:latest";
          ports = [
            "0.0.0.0:3002:3000"
          ];
          environment = {
            VITE_API_URL = "http://rtmp-to-whip:3000";
          };
          extraOptions = [ "--network=rtmp-to-whip" ];
        };
      };

      networking.firewall = {
        allowedTCPPorts = [ 1935 ];
        allowedUDPPorts = [ 6969 ];
      };

      services.caddy = pkgs.lib.mkIf config.services.caddy.enable {
        virtualHosts."stream.h.doloro.co.uk".extraConfig = ''
          reverse_proxy :3002
        '';
      };
    };
  };
}