{services, ...}:

{
  security.acme.acceptTerms = true;
  security.acme.email = "giupi@giugl.io";

  services.nginx = {
    enable                   = true;
    recommendedGzipSettings  = true;
    recommendedOptimisation  = true;
    recommendedProxySettings = true;
    recommendedTlsSettings   = true;

    virtualHosts."media.giugl.io" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://localhost:8096";
        extraConfig = ''
          allow 10.0.0.0/24;
          allow 10.3.0.0/24;
          deny all;
        '';
      };
    };

    virtualHosts."htbaz.giugl.io" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://localhost:6767";
        extraConfig = ''
          allow 10.0.0.0/24;
          allow 10.3.0.0/24;
          deny all;
        '';
      };
    };

    virtualHosts."htrad.giugl.io" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://localhost:7878";
        extraConfig = ''
          allow 10.0.0.0/24;
          allow 10.3.0.0/24;
          deny all;
        '';
      };
    };

    virtualHosts."htson.giugl.io" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://localhost:8989";
        extraConfig = ''
          allow 10.0.0.0/24;
          allow 10.3.0.0/24;
          deny all;
        '';
      };
    };

    virtualHosts."htnzb.giugl.io" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://localhost:6789";
        extraConfig = ''
          allow 10.0.0.0/24;
          allow 10.3.0.0/24;
          deny all;
        '';
      };
    };
  };
}