{
  name,
  hostInfo,
  dsl,
  ...
}:
let
  inherit (dsl) mkContainer mkService;
  inherit (hostInfo.paths) data secrets;
in
mkContainer {
  inherit name;
  net.access = [ { to = "@internet"; } ];
  svc.autoStart = true;
  resources.fs = {
    "/config" = {
      hostPath = "${data}/web/devenv/config";
      isReadOnly = false;
    };
    "/workspace" = {
      hostPath = "${data}/web/devenv/workspace";
      isReadOnly = false;
    };
    "/run/secrets/code-server-env" = {
      hostPath = "${secrets}/code-server-env";
      isReadOnly = true;
    };
  };
  users = [
    {
      name = "coder";
      uid = 1000;
      home = "/config";
    }
  ];
  service =
    { pkgs, lib, ... }:
    mkService {
      description = "code-server";
      execStart = "${lib.getExe' pkgs.code-server "code-server"} --bind-addr 0.0.0.0:8080 --user-data-dir /config/data --extensions-dir /config/extensions --auth password /workspace";
      networkOnline = true;
      serviceConfig = {
        EnvironmentFile = "/run/secrets/code-server-env";
        User = "coder";
        ReadWritePaths = [
          "/config"
          "/workspace"
        ];
      };
    };
  net.expose.tcp = [ 8080 ];
  resources.mem = "4G";
  resources.cpu = 2;
}