{ config, lib, pkgs, ... }:
{
  virtualisation.podman.enable = true;

  # User containers (rootless, as the containers user)
  system.activationScripts.containers-quadlets = {
    text = ''
      mkdir -p /var/lib/containers/.config/containers/systemd
      cp -r ${./containers}/* /var/lib/containers/.config/containers/systemd/
      chown -R containers:containers /var/lib/containers/.config
    '';
    deps = [ "users" ];
  };

  # System containers (rootful, can bind low ports like 80/443)
  system.activationScripts.system-containers-quadlets = {
    text = ''
      mkdir -p /etc/containers/systemd
      cp -r ${./system-containers}/* /etc/containers/systemd/
    '';
    deps = [ "users" ];
  };
}