{
  kubernetes.resources = {
    configMaps.kitchenowl.data = {
      BACK_URL = "kitchenowl-backend.default.svc.cluster.local:5000";
    };

    secrets.kitchenowl.stringData.jwtSecretKey = "ref+sops://secrets/sops.yaml#/kitchenowl/jwtSecretKey";

    deployments = {
      # TODO: this is quite a lot of boilerplate to create these deployments
      # Create custom nixos module for this?
      kitchenowl-frontend = {
        metadata.labels = {
          app = "kitchenowl";
          component = "frontend";
        };

        spec = {
          selector.matchLabels = {
            app = "kitchenowl";
            component = "frontend";
          };

          template = {
            metadata.labels = {
              app = "kitchenowl";
              component = "frontend";
            };

            spec.containers.kitchenowl-frontend = {
              image = "tombursch/kitchenowl-web:v0.4.20";
              envFrom = [{ configMapRef.name = "kitchenowl"; }];
              ports.web.containerPort = 80;
            };
          };
        };
      };

      kitchenowl-backend = {
        metadata.labels = {
          app = "kitchenowl";
          component = "backend";
        };

        spec = {
          selector.matchLabels = {
            app = "kitchenowl";
            component = "backend";
          };

          template = {
            metadata.labels = {
              app = "kitchenowl";
              component = "backend";
            };

            spec = {
              volumes.data.persistentVolumeClaim.claimName = "kitchenowl";

              containers.kitchenowl-backend = {
                image = "tombursch/kitchenowl:v92";
                ports.web.containerPort = 5000;

                volumeMounts = [{
                  name = "data";
                  mountPath = "/data";
                }];
              };
            };
          };
        };
      };
    };

    persistentVolumes.kitchenowl.spec = {
      capacity.storage = "1Mi";
      accessModes = [ "ReadWriteMany" ];

      nfs = {
        server = "lewis.dmz";
        path = "/mnt/data/nfs/kitchenowl/data";
      };
    };

    persistentVolumeClaims.kitchenowl.spec = {
      accessModes = [ "ReadWriteMany" ];
      storageClassName = "";
      resources.requests.storage = "1Mi";
      volumeName = "kitchenowl";
    };

    services = {
      kitchenowl-web.spec = {
        selector = {
          app = "kitchenowl";
          component = "frontend";
        };

        ports.web = {
          port = 80;
          targetPort = "web";
        };
      };

      kitchenowl-backend.spec = {
        selector = {
          app = "kitchenowl";
          component = "backend";
        };

        ports.web = {
          port = 5000;
          targetPort = "web";
        };
      };
    };

    ingresses.kitchenowl = {
      metadata.annotations."cert-manager.io/cluster-issuer" = "letsencrypt";

      spec = {
        ingressClassName = "traefik";

        rules = [{
          host = "boodschappen.kun.is";

          http.paths = [{
            path = "/";
            pathType = "Prefix";

            backend.service = {
              name = "kitchenowl-web";
              port.name = "web";
            };
          }];
        }];

        tls = [{
          secretName = "kitchenowl-tls";
          hosts = [ "boodschappen.kun.is" ];
        }];
      };
    };
  };
}