{ config, pkgs, inputs, lib, ... }:
let
  port = 8123;
  path = "/data/nginx";
  certPath = "${path}/cert.pem";
  keyPath = "${path}/key.pem";
in {
  imports = [ ../nginx.nix ./virtualisation.nix ];

  networking.firewall.allowedTCPPorts = [ port ];

  services.nginx = {
    virtualHosts = {
      "bolty.raptor-carp.ts.net" = {
        forceSSL = true;
        enableACME = false;
        locations."/" = {
          proxyPass = "http://10.0.0.244:8123";
          proxyWebsockets = true;
        };
        sslCertificateKey = keyPath;
        sslCertificate = certPath;
      };
    };
  };

  systemd.services.nginx-tailscale-certs = {
    script = ''
      mkdir -p ${path}
      cp -rv /var/lib/tailscale-certs/cert.pem ${certPath}
      cp -rv /var/lib/tailscale-certs/key.pem ${keyPath}
      chown -Rv nginx:nginx ${path}
    '';
    serviceConfig = {
      Type = "oneshot";
      ReloadPropagatedFrom = "tailscale-cert.service";
    };
    before = [ "nginx.service" ];
    wantedBy = [ "multi-user.target" ];
    after = [
      "network.target"
      "network-online.target"
      "tailscaled.service"
      "tailscale-cert.service"
    ];
    wants = [ "tailscale-cert.service" ];
  };

}