{
  pkgs,
  hostInfo,
  dsl,
  self,
  lib,
  customPkgs,
  ...
}:
let
  inherit (dsl) mkContainer;
  inherit (hostInfo.paths) server data;

  sshTrait = {
    resources.fs."/etc/ssh/authorized_keys" = {
      hostPath = "${server}/keypair/id_ed25519.pub";
      isReadOnly = true;
    };
    users = [
      {
        name = "runner";
        uid = 1000;
      }
    ];
    containerConfig =
      {
        lib,
        pkgs,
        ...
      }:
      lib.mkMerge [
        {
          services.openssh = {
            enable = true;
            authorizedKeysFiles = [ "/etc/ssh/authorized_keys" ];
            settings = {
              PasswordAuthentication = false;
              UseDns = false;
              PrintMotd = false;
            };
          };
          systemd.services.sshd.serviceConfig.FailureAction = "exit-force";
        }
        {
          environment.systemPackages = [
            customPkgs.kitty-terminfo
            pkgs.wezterm.terminfo
          ];
        }
      ];
  };

  mkSsh =
    {
      name,
      packages ? [ ],
      nixDaemon ? true,
      routingInfo ? {
        username = lib.strings.removePrefix "ssh-" name;
      },
      net ? { },
      resources ? { },
      traits ? [ ],
      isolation ? { },
    }:
    mkContainer {
      inherit name;
      inherit net resources;
      svc.autoStart = true;
      isolation = { nixDaemon = nixDaemon; } // isolation;
      traits = [ sshTrait ] ++ traits;
      packages = with pkgs; [ tmux ] ++ packages;
      miscProperties = self._sshpiperRegister routingInfo;
    };

  kvmTrait = {
    containerConfig =
      { pkgs, ... }:
      {
        users.users.runner.extraGroups = [ "wheel" ];
        security.sudo.wheelNeedsPassword = false;
        environment.systemPackages = [ pkgs.qemu_kvm ];
      };
  };
in
{
  ssh-admin = mkSsh {
    name = "ssh-admin";
    net.access = [
      {
        to = "overseer";
        tcp = [ 80 ];
      }
    ];
    resources.fs = {
      "/home/runner/data" = {
        hostPath = server;
        isReadOnly = false;
      };
      "/run/dbus/system_bus_socket" = {
        hostPath = "/run/dbus/system_bus_socket";
        isReadOnly = false;
      };
    };
    packages = with pkgs; [
      git
      systemd
    ];
  };

  ssh-botm = mkSsh {
    name = "ssh-botm";
    resources.fs."/home/runner/botm" = {
      hostPath = "${data}/mc/botm";
      isReadOnly = false;
    };
    packages = with pkgs; [
      python3
      jdk17
      tmux
    ];
  };

  ssh-generic = mkSsh {
    name = "ssh-generic";
    net.access = [ { to = "@internet"; } ];
    resources = {
      fs."/home/runner/data" = {
        hostPath = "${data}/ssh/generic";
        isReadOnly = false;
      };
      mem = "16G";
      cpu = 65;
    };
    traits = [ kvmTrait ];
    isolation.allowedDevices = [
      {
        node = "/dev/kvm";
        modifier = "rw";
      }
      {
        node = "/dev/vhost-net";
        modifier = "rw";
      }
      {
        node = "/dev/net/tun";
        modifier = "rwm";
      }
    ];
    isolation.additionalCapabilities = [
      "CAP_NET_ADMIN"
      "CAP_MKNOD"
    ];
    routingInfo = [
      {
        username = "autumn";
        keysName = "generic";
      }
    ];
  };

  ssh-proxy = mkSsh {
    name = "ssh-proxy";
    resources.fs."/home/runner/data" = {
      hostPath = "${data}/ssh/nyaa";
      isReadOnly = true;
    };
    packages = with pkgs; [ python3 ];
    routingInfo = [
      {
        username = "nyaa";
        keysName = "nyaa";
      }
    ];
  };

  ssh-rogule = mkSsh {
    name = "ssh-rogule";
    resources.fs = {
      "/home/runner/rogule-dev" = {
        hostPath = "${data}/mc/rogule-dev";
        isReadOnly = false;
      };
      "/home/runner/rogule-build" = {
        hostPath = "${data}/mc/rogule-build";
        isReadOnly = false;
      };
    };
    packages = with pkgs; [
      python3
      jdk21
    ];
  };

  ssh-starwalker = mkSsh {
    name = "ssh-starwalker";
    resources.fs."/home/runner/starwalker" = {
      hostPath = "${data}/mc/starwalker";
      isReadOnly = false;
    };
    packages = with pkgs; [
      jdk21
    ];
  };

  ssh-tl = mkSsh {
    name = "ssh-tl";
    resources.fs."/home/runner/tl" = {
      hostPath = "${data}/mc/tl";
      isReadOnly = false;
    };
    packages = with pkgs; [
      jdk21
    ];
  };
}