{
  name,
  pkgs,
  lib,
  hostInfo,
  dsl,
  inputs,
  ...
}:
let
  inherit (dsl) mkContainer mkService;
  inherit (hostInfo.paths) data secrets;
  inherit (inputs) mtce;
  dataDir = "/var/lib/mtce-bot";

  threads = 64;
  timeout = 1800;

  configJson = pkgs.writeText "mtce-bot-config.json" (
    builtins.toJSON {
      inherit threads timeout;
    }
  );

  mtce-engine = mtce.lib.mkMtce pkgs {
    cpuFlags = [
      "-O3"
      "-march=cascadelake"
    ];
    vectorizedBitSize = 512;
  };
  mtce-bot = mtce.lib.mkBot pkgs;
in
mkContainer {
  inherit name;
  svc.autoStart = true;
  resources.fs = {
    "${dataDir}/data.json" = {
      hostPath = "${data}/misc/mtce-discord-bot/data.json";
      isReadOnly = false;
    };
    "${dataDir}/audit" = {
      hostPath = "${data}/misc/mtce-discord-bot/audit";
      isReadOnly = false;
    };
    "${dataDir}/config.json" = {
      hostPath = "${configJson}";
      isReadOnly = true;
    };
    "${dataDir}/mtce" = {
      hostPath = lib.getExe' mtce-engine "mtce";
      isReadOnly = true;
    };
    "/run/secrets/mtce-discord-bot-env" = {
      hostPath = "${secrets}/mtce-discord-bot-env";
      isReadOnly = true;
    };
  };
  users = [
    {
      name = "bot";
      uid = 1000;
    }
  ];
  service =
    _:
    mkService {
      description = "Discord bot (monumenta-charm-eval)";
      execStart = lib.getExe' mtce-bot "mtce-bot";
      workingDir = dataDir;
      networkOnline = true;
      serviceConfig = {
        User = "bot";
        EnvironmentFile = "/run/secrets/mtce-discord-bot-env";
        PrivateTmp = true;
        CapabilityBoundingSet = "";
        ReadWritePaths = [ dataDir ];
      };
    };
  resources.mem = "2G";
  resources.cpu = 64;
  net.access = [ { to = "@internet"; } ];
  includedInTests = false;
}