{ me, config, ... }:

{
  imports = [
    ../../modules/common.nix

    ./hardware.nix
    ./devices.nix

    ../../modules/www.nix

    ../../services/conduwuit.nix
    ../../services/pds.nix
    ../../services/akkoma
  ];

  foundation.monitoring = {
    client.enable = true;
    services = [ "base" "akkoma" "pds" "conduwuit" ];
  };

  age.secrets.cloudflare-dns = {
    file = ../../secrets/cloudflare-dns.age;
  };

  security.acme.certs."pds.rnrd.eu" = {
    group = "nginx";
    domain = "*.pds.rnrd.eu";
    extraDomainNames = [ "pds.rnrd.eu" ];
    dnsProvider = "cloudflare";
    credentialFiles = {
      CLOUDFLARE_DNS_API_TOKEN_FILE = config.age.secrets.cloudflare-dns.path;
    };
  };

  services.nginx.virtualHosts = {
    "soc.rnrd.eu" = {
      forceSSL = true;
      enableACME = true;

      locations."/" = {
        proxyWebsockets = true;
        proxyPass = "http://127.0.0.1:1111";
      };

      extraConfig = ''
        access_log /var/log/nginx/akkoma.access.log json_combined;
      '';
    };

    "pds.rnrd.eu" = {
      serverAliases = [ "*.pds.rnrd.eu" ];
      forceSSL = true;
      useACMEHost = "pds.rnrd.eu";

      locations."/" = {
        proxyWebsockets = true;
        proxyPass = "http://127.0.0.1:16419";
      };

      extraConfig = ''
        access_log /var/log/nginx/pds.access.log json_combined;
      '';
    };
  };

  system.stateVersion = "23.05";
}