{
  flake.nixosModules.wallabag = {
    config,
    lib,
    ...
  }: let
    cfg = config.hive.wallabag;
  in {
    options.hive.wallabag = {
      enable = lib.mkEnableOption "Enable wallabag service";
      localPort = lib.mkOption {
        type = lib.types.int;
        example = 8080;
        default = 39128;
        description = "Specify the local port wallabag server uses.";
      };
      instanceFQDN = lib.mkOption {
        type = lib.types.singleLineStr;
        example = "wallabag.example.com";
        description = "Fully qualified domain name of the wallabag instance";
      };
    };

    config = lib.mkIf cfg.enable {
      # Fallback server with only 403
      services.nginx.virtualHosts.${config.networking.domain} = lib.mkDefault {
        default = true;
        locations."/".return = 403;
        forceSSL = true;
        enableACME = true;
      };

      # Virtual host for korrosync
      services.nginx.virtualHosts."${cfg.instanceFQDN}" = {
        forceSSL = true;
        enableACME = true;
        locations."/".proxyPass = "http://127.0.0.1:${toString cfg.localPort}";
      };

      virtualisation.oci-containers.containers.wallabag = {
        image = "wallabag/wallabag:latest";
        ports = ["127.0.0.1:${toString cfg.localPort}:80"];
        volumes = [
          "wallabag-data:/var/www/wallabag/data"
          "wallabag-images:/var/www/wallabag/web/assets/images"
        ];
        environment = {
          "SYMFONY__ENV__DOMAIN_NAME" = "https://${cfg.instanceFQDN}:${toString cfg.localPort}";
        };
      };
    };
  };
}