{ ... }: {

    flake.nixosModules.openwebui = { config, lib, pkgs, ... }: let

    subdomain = "ai";

    name = "openwebui";

    in {

        config = {

            virtualisation.oci-containers.containers.openwebui = {
                image = "ghcr.io/open-webui/open-webui:v0.7.2";

# unstable, waiting for 26.05
#pull = "newer";

                hostname = "${subdomain}.esotericbytes.com";

                networks = [
                    "docker-main"
                ];

                /*ports = [
                  "${builtins.toString hostPort}:8080"
                  ];*/

                volumes = [
                    "vol_openwebui:/app/backend/data"
                ];

                labels = {
                    "traefik.enable" = "true";
                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
                    "traefik.http.routers.${name}.service" = "${name}";
                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";

                    "traefik.http.services.${name}.loadbalancer.server.port" = "8080";
                };

                extraOptions = lib.mkIf config.hardware.nvidia-container-toolkit.enable [
                    "--device=nvidia.com/gpu=all"
                        "--ip=192.168.101.8"
                ];

                environment = {
                };
            };

            systemd.services."docker-openwebui" = {
                serviceConfig = {
                    Restart = lib.mkOverride 90 "always";
                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
                    RestartSec = lib.mkOverride 90 "100ms";
                    RestartSteps = lib.mkOverride 90 9;
                };
                after = [
                    "docker-network-setup.service"
                        "docker-volume-openwebui.service" 
                ];
                requires = [
                    "docker-network-setup.service"
                        "docker-volume-openwebui.service" 
                ];
                partOf = [
                    "docker-compose-openwebui-root.target"
                ];
                wantedBy = [
                    "docker-compose-openwebui-root.target"
                ];
            };

            systemd.services."docker-volume-openwebui" = {
                path = [ pkgs.docker ];
                serviceConfig = {
                    Type = "oneshot";
                    RemainAfterExit = true;
                };
                script = ''
                    docker volume inspect vol_openwebui || docker volume create vol_openwebui --driver=local
                    '';
                partOf = [ "docker-compose-openwebui-root.target" ];
                wantedBy = [ "docker-compose-openwebui-root.target" ];
            };

            systemd.targets."docker-compose-openwebui-root" = {
                wantedBy = [ "multi-user.target" ];
            };

        };
    };
}