{ config, ... }:

{
  nix.sshServe.enable = true;

  services.nix-serve = {
    enable = true;
    secretKeyFile = "/var/lib/nix-serve.key";
  };

  services.nginx = {
    enable = true;
    virtualHosts = let
      vhost.locations."/".proxyPass =
        "http://${config.services.nix-serve.bindAddress}:${
          toString config.services.nix-serve.port
        }";
    in {
      "cache.server7.hq.c3d2.de" = vhost // {
        addSSL = true;
        enableACME = true;
      };
      "nix-serve.y.c3d2.de" = vhost;
    };
  };

}