{ config, lib, pkgs, ... }:
{
  security.acme = {
    acceptTerms = true;
    defaults.email = "letsencrypt@bogaledev.ru";
    certs."bogaledev.ru" = {
      validMinDays = 3;
      dnsProvider = "cloudflare";
      extraDomainNames = [ "*.bogaledev.ru" ];
      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
    };
  };
  services = let
    sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
  in {
    postgresql.enable = true;
    phpfpm.pools.default = {
      user = "php";
      group = "php";
      settings = {
        "pm" = "ondemand";
        "pm.max_children" = 8;
        "listen.owner" = "nginx";
        "listen.group" = "nginx";
      };
    };
    forgejo = {
      enable = true;
      database.type = "postgres";
      settings = {
        service.DISABLE_REGISTRATION = true; 
        server = {
          HTTP_PORT = 8039;
          ROOT_URL = "https://bogaledev.ru/git/";
        };
      };
    };
    vaultwarden = {
      enable = true;
      dbBackend = "postgresql";
      configurePostgres = true;
      package = pkgs.vaultwarden-postgresql;
      environmentFile = "/secrets/vw-token.env";
      config = {
        ROCKET_PORT = 8032;
        SIGNUPS_ALLOWED = false;
        TRASH_AUTO_DELETE_DAYS = 90;
        PASSWORD_HINTS_ALLOWED = false;
        EMERGENCY_ACCESS_ALLOWED = false;
        DOMAIN = "https://bogaledev.ru/vw/";
      };
    };
    nginx.virtualHosts."bogaledev.ru" = let
      phpPool = pool: ''
        location ~ \.php$ {
          fastcgi_pass unix:${config.services.phpfpm.pools.${pool}.socket};
        }
      '';
      localNetworks = ''
        allow fc00::/64;
        allow fc01::/120;
        allow 10.0.0.0/16;
        allow 10.1.0.0/24;
        deny all;
      '';
    in {
      quic = true;
      default = true;
      forceSSL = true;
      root = "/srv/http";
      useACMEHost = "bogaledev.ru";
      extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;'';
      locations = {
        "/app/".extraConfig = phpPool "default";
        "/git/".proxyPass = "http://127.0.0.1:8039/";
        "/local/".extraConfig = ''${phpPool "default"} ${localNetworks}'';
        "/local/net/".extraConfig = ''
          allow fc01::/64;
          allow 10.1.0.0/16;
          deny all;
        '';
        "/vw/" = {
          proxyWebsockets = true;
          extraConfig = localNetworks;
          proxyPass = "http://127.0.0.1:8032";
        };
      };
    };
  };
}