{ config, lib, pkgs, ... }:
{
  security.acme = {
    acceptTerms = true;
    defaults.email = "letsencrypt@bogaledev.ru";
    certs."bogaledev.ru" = {
      validMinDays = 3;
      dnsProvider = "cloudflare";
      extraDomainNames = [ "*.bogaledev.ru" ];
      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
    };
  };
  services = let
    sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
  in {
    postgresqlBackup = {
      enable = true;
      compression = "none";
      databases = [ "php" "forgejo" "vaultwarden" ];
    };
    postgresql = {
      enable = true;
      ensureDatabases = [ "php" ];
      ensureUsers = [ {
        name = "php";
        ensureDBOwnership = true;
      } ];
    };
    forgejo = {
      enable = true;
      database.type = "postgres";
      settings.server = {
        HTTP_PORT = 8039;
        ROOT_URL = "https://bogaledev.ru/git/";
      };
    };
    phpfpm.pools.php = {
      user = "php";
      group = "php";
      phpEnv = { PATH = "/run/current-system/sw/bin"; };
      settings = {
        "pm" = "ondemand";
        "pm.max_children" = 4;
        "listen.owner" = "nginx";
        "listen.group" = "nginx";
      };
    };
    vaultwarden = {
      enable = true;
      dbBackend = "postgresql";
      configurePostgres = true;
      package = pkgs.vaultwarden-postgresql;
      environmentFile = "/secrets/vw-token.env";
      config = {
        ROCKET_PORT = 8032;
        SIGNUPS_ALLOWED = false;
        TRASH_AUTO_DELETE_DAYS = 90;
        PASSWORD_HINTS_ALLOWED = false;
        EMERGENCY_ACCESS_ALLOWED = false;
        DOMAIN = "https://bogaledev.ru/vw/";
      };
    };
    nginx.virtualHosts."bogaledev.ru" = let
      phpPool = ''
        location ~ \.php$ {
          fastcgi_pass unix:${config.services.phpfpm.pools.php.socket};
        }
      '';
      localNetworks = ''
        allow fc00::/64;
        allow fc01::/120;
        allow 10.0.0.0/16;
        allow 10.1.0.0/24;
        deny all;
      '';
    in {
      quic = true;
      default = true;
      forceSSL = true;
      root = "/srv/http";
      useACMEHost = "bogaledev.ru";
      extraConfig = ''
        add_header Alt-Svc 'h3=":443"; ma=2592000' always;
        add_header X-Content-Type-Options "nosniff" always;
      '';
      locations = {
        "/git/".proxyPass = "http://127.0.0.1:8039/";
        "/" = {
          extraConfig = phpPool;
          index = "index.php index.html";
        };
        "/local/" = {
          extraConfig = "${phpPool} ${localNetworks}";
          index = "index.php index.html";
        };
        "/local/net/".extraConfig = ''
          allow fc01::/64;
          allow 10.1.0.0/16;
          deny all;
        '';
        "/vw/" = {
          proxyWebsockets = true;
          extraConfig = localNetworks;
          proxyPass = "http://127.0.0.1:8032";
        };
      };
    };
  };
}