{config, ...}: {
  m3ta.ports = {
    enable = true;
    definitions = {
      # System services
      ssh = 22;

      # Web & proxy services
      traefik = 80;
      traefik-ssl = 443;

      # Databases
      postgres = 5432;
      mysql = 3306;
      redis = 6379;

      # VPN & networking
      wireguard = 51820;
      tailscale = 41641;
      headscale = 3009;

      # Containers & web apps
      gitea = 3030;
      baserow = 3001;
      ghost = 3002;
      wastebin = 3003;
      littlelink = 3004;
      searx = 3005;
      restreamer = 3006;
      paperless = 3012;
      vaultwarden = 3013;
      slash = 3010;
      slash-nemoti = 3016;
      kestra = 3018;
      outline = 3019;
      pangolin = 3020;
      pangolin-api = 3021;
      pangolin-ws = 3022;

      # Home automation
      homarr = 7575;

      # DNS
      adguardhome = 53;
    };

    hostOverrides = {
      # Host-specific overrides
      m3-ares = {
        # Any custom port overrides for m3-ares
      };

      m3-atlas = {
        # Any custom port overrides for m3-atlas
      };

      m3-helios = {
        # Any custom port overrides for m3-helios
      };

      m3-kratos = {
        # Any custom port overrides for m3-kratos
      };
    };
  };
  environment.etc."info/all-ports.json" = {
    text = builtins.toJSON {
      hostname = config.networking.hostName;
      ports = config.m3ta.ports.all; # TODO should only return actually used ports
    };
  };
}