{ ... }:
let
  db_pass = import ../config/_passwords.nix;
in
{
  my-lxc.mqtt = {
    container = {
      cores = 1;
      memory = 512;
      disk = "5G";
      swap = 512;
    };
    system = {
      additionalPorts = [
        1883
        9001
      ];
      importConfig = [
        ../config/mqtt-mosquitto.nix
      ];
    };
    logging = {
      enable = true;
      metricsEnable = true;
      prometheusPorts = {
        mosquitto = 9000;
      };
      journalLoggers.mosquitto = ''
        stage.regex {
          expression = "^(?P<timestamp>\\d+): (?P<client_id>\\S+) (?P<message>.*)$"
        }
        stage.timestamp {
          source = "timestamp"
          format = "Unix"
        }
        stage.labels {
          values = {
            client_id = "",
          }
        }
        stage.output {
          source = "message" 
        }
      '';
    };
    private = true; # available only on private lan
    auth = true; # auth overlay
  };
}