{config, ...}: {
  services.etebase-server = {
    enable = true;
    port = 8001;
    settings = {
      global.secret_file = "${config.age.secrets.etebase-server.path}";
      allowed_hosts.allowed_host1 = "127.0.0.1";
    };
  };

  services.nginx = {
    enable = true;
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedProxySettings = true;

    virtualHosts = {
      "etebase.vhack.eu" = {
        enableACME = true;
        forceSSL = true;

        locations."/" = {
          proxyPass = "http://127.0.0.1:8001";
          extraConfig = ''
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Host $server_name;
          '';
        };
        serverAliases = [
          "dav.vhack.eu"
        ];
      };
    };
  };
}