{ pkgs, lib, config, ... }: {

  services.jupyter = {
    enable = true;
    ip = "0.0.0.0";
    #In [1]: from notebook.auth import passwd
    #In [2]: passwd('test')
    #Out[2]: 'sha1:1b961dc713fb:88483270a63e57d18d43cf337e629539de1436ba'
    #NOTE: you need to keep the single quote inside nix string.
    password = "'sha1:1b961dc713fb:88483270a63e57d18d43cf337e629539de1436ba'";
    kernels = {
      python3 =
        let
          env = (pkgs.python3.withPackages (pythonPackages:
            with pythonPackages; [
              ipykernel
              pandas

              # database stuff
              mysqlclient
              databases
              asyncpg
              psycopg2
              aiomysql
              pymysql
              aiosqlite
              #aiopg
              sqlalchemy

              # pdf export
              nbconvert
            ]));
        in
        {
          displayName = "Python 3";
          argv = [
            "${env.interpreter}"
            "-m"
            "ipykernel_launcher"
            "-f"
            "{connection_file}"
          ];
          language = "python";
        };
    };
  };

  # to generate pdfs and such
  environment.systemPackages = [ pkgs.pandoc ];

  backup.dirs = [ "/var/lib/jupyter" ];
  backup.exclude =
    [ "/var/lib/jupyter/.local" "/var/lib/jupyter/.ipynb_checkpoints" ];

  services.nginx = {
    enable = true;
    statusPage = true;
    virtualHosts = {
      "python.${config.networking.hostName}.private" = {
        serverAliases = [ "jupyter.${config.networking.hostName}.private" ];
        locations."/" = {
          proxyWebsockets = true;
          proxyPass = "http://${config.networking.hostName}.private:${
              toString config.services.jupyter.port
            }";
        };
      };
    };
  };

}