{ config, lib, pkgs, ... }:
{
  virtualisation.podman.enable = true;

  # System-level containers (rootful, can bind low ports)
  # Declared here so NixOS handles daemon-reload properly
  virtualisation.oci-containers = {
    backend = "podman";
    containers = {
      caddy = {
        image = "caddy:latest";
        ports = [
          "80:80"
          "443:443"
        ];
        volumes = [
          "/var/lib/caddy/data:/data"
          "/var/lib/caddy/config:/config"
        ];
      };
    };
  };

  # User containers (rootless, as the containers user via quadlets)
  system.activationScripts.containers-quadlets = {
    text = ''
      mkdir -p /var/lib/containers/.config/containers/systemd
      cp -r ${./containers}/* /var/lib/containers/.config/containers/systemd/
      chown -R containers:containers /var/lib/containers/.config
    '';
    deps = [ "users" ];
  };
}