code:

  # code for creating hass user/group omitted
  # docker configuration
  virtualisation.oci-containers.containers.homeassistant = let
    users = config.users.users;
    groups = config.users.groups;
  in {
    user = "${toString users.hass.uid}:${toString groups.hass.gid}";
    volumes = [
      "/var/lib/hass:/config"
      "/run/dbus:/run/dbus:ro"  # for bluetooth
    ];
    environment.TZ = "America/Toronto";
    # TODO: replace with sha256 so it gets re-fetched when updated
    image = "ghcr.io/home-assistant/home-assistant:stable";
    extraOptions = [
      "--network=host"
      # extra GIDs need to match the GIDs on the host system to access the stuff in /dev
      "--device=/dev/ttyACM0" "--group-add=${toString groups.dialout.gid}"
      "--device=/dev/snd" "--group-add=${toString groups.audio.gid}"
      "--device=/dev/video0" "--group-add=${toString groups.video.gid}"
    ];
  };

  # Give hass rw on the zigbee dongle
  services.udev.extraRules = ''
    SUBSYSTEM=="usb", ATTR{idVendor}=="1a86", ATTR{idProduct}=="55d4", OWNER="hass", GROUP="hass""
  '';

  # Reverse proxy for external access
  services.nginx.virtualHosts."home.example.com" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:8133/";
      proxyWebsockets = true;
    };
  };