{
  config,
  pkgs,
  lib,
  ...
}: {
  # Keep fail2ban as OCI container to preserve the web UI
  virtualisation.oci-containers.containers.fail2ban = {
    image = "crazymax/fail2ban:latest";
    autoStart = true;
    volumes = [
      "/home/admin/dms/mail-logs:/var/log/mail:ro"
      "/home/admin/fail2ban/data:/data:Z"
    ];
    environment = {
      TZ = "Europe/Amsterdam";
    };
    extraOptions = [
      "--network=host"
      "--cap-add=NET_ADMIN"
    ];
  };

  systemd.tmpfiles.rules = [
    "d /var/log/mail 0755 root root -"
  ];
}
