{ pkgs, lib, config, ... }: {

  services.jupyter = {
    enable = true;
    ip = "0.0.0.0";
    #In [1]: from notebook.auth import passwd
    #In [2]: passwd('test')
    #Out[2]: 'sha1:1b961dc713fb:88483270a63e57d18d43cf337e629539de1436ba'
    #NOTE: you need to keep the single quote inside nix string.
    password = "'sha1:1b961dc713fb:88483270a63e57d18d43cf337e629539de1436ba'";
    kernels = {
      python3 = let
        env = (pkgs.python3.withPackages (pythonPackages:
          with pythonPackages; [
            ipykernel
            pandas

            # database stuff
            mysqlclient
            databases
            asyncpg
            psycopg2
            aiomysql
            pymysql
            aiosqlite
            #aiopg
            sqlalchemy

            # pdf export
            nbconvert
          ]));
      in {
        displayName = "Python 3";
        argv = [
          "${env.interpreter}"
          "-m"
          "ipykernel_launcher"
          "-f"
          "{connection_file}"
        ];
        language = "python";
      };
    };
  };

  # to generate pdfs and such
  environment.systemPackages = [ pkgs.pandoc ];

  backup.dirs = [ "/var/lib/jupyter" ];
  backup.exclude =
    [ "/var/lib/jupyter/.local" "/var/lib/jupyter/.ipynb_checkpoints" ];

  services.nginx = {
    enable = true;
    statusPage = true;
    virtualHosts = {
      "python.${config.networking.hostName}.private" = {
        serverAliases = [ "jupyter.${config.networking.hostName}.private" ];
        locations."/" = {
          proxyWebsockets = true;
          proxyPass = "http://${config.networking.hostName}.private:${
              toString config.services.jupyter.port
            }";
        };
      };
    };
  };

}