{...}: {
  # Keep fail2ban as OCI container to preserve the web UI
  virtualisation.oci-containers.containers.fail2ban = {
    image = "crazymax/fail2ban:latest";
    autoStart = true;
    volumes = [
      "/home/admin/fail2ban/data:/data:Z"
    ];
    environment = {
      TZ = "Europe/Amsterdam";
    };
    extraOptions = [
      "--network=host"
      "--cap-add=NET_ADMIN"
    ];
  };
}