{ lib, pkgs, config, ...}:

{
  services.nginx = {
    enable = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = false;
    # pulls in the domainname set for ntfy
    virtualHosts."ntfy.lo-probst.de" = {
      enableACME = true;
      acmeRoot = null;
      forceSSL = true;
#      sslCertificate = "/var/lib/acme/ntfy.lo-probst.de/fullchain.pem";
      # directs traffic to the appropriate port for ntfy
      locations."/" = {
        proxyPass = "http://localhost:8080";
        # proxyPass = "http://localhost:3000";
        proxyWebsockets = true;
      };
    };
    virtualHosts."${config.services.forgejo.settings.server.DOMAIN}" = {
      enableACME = true;
      acmeRoot = null;
      forceSSL = true;
      extraConfig = ''
        client_max_body_size 512M;
      '';
      locations."/" = {
        proxyPass = "http://localhost:${toString config.services.forgejo.settings.server.HTTP_PORT}";
      };
    };
#    virtualHosts."oh.lo-probst.de" = {
#      enableACME = true;
#      acmeRoot = null;
#      forceSSL = true;
#      locations."/" = {
#        proxyPass = "https://192.168.2.221:9443";
#      };
#    };
  };
  security.acme = {
    acceptTerms = true;
    defaults = {
      email = "admin-infra-one@lo-probst.de";
      dnsProvider = "ionos";
      # API for authentication to DNA provider e.g.
      # CF_API_EMAIL=<insert-dns-account-email>
      # specify file if not using agenix
      credentialFiles = {
        "IONOS_API_KEY_FILE" = "/etc/secrets/ionos-acme-infra-one.txt";
      };
    };
  };
  users.users.nginx.extraGroups = [ "acme" ];
}