{
  config,
  service_configs,
  username,
  ...
}:
{
  services.caddy = {
    enable = true;
    email = "titaniumtown@proton.me";
    globalConfig = ''
      auto_https disable_redirects
    '';
    virtualHosts = {
      ${service_configs.https.domain} = {
        extraConfig = ''
          root * ${service_configs.https.data_dir}
          file_server browse
        '';

        serverAliases = [ "www.${service_configs.https.domain}" ];
      };

      "immich.${service_configs.https.domain}".extraConfig = ''
        reverse_proxy :${builtins.toString config.services.immich.port}
      '';

      "jellyfin.${service_configs.https.domain}".extraConfig = ''
        reverse_proxy :${builtins.toString service_configs.ports.jellyfin}
        request_body {
        	max_size 4096MB
        }
      '';

      ${service_configs.gitea.domain}.extraConfig = ''
        reverse_proxy :${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
      '';

      "bitmagnet.${service_configs.https.domain}".extraConfig = ''
        tls internal
        ${import ../secrets/caddy_auth.nix}
        reverse_proxy http://192.168.15.1:${builtins.toString service_configs.ports.bitmagnet}
      '';

      "torrent.${service_configs.https.domain}".extraConfig = ''
        tls internal
        ${import ../secrets/caddy_auth.nix}
        reverse_proxy http://192.168.15.1:${builtins.toString service_configs.ports.torrent}
      '';
    };
  };

  networking.firewall.allowedTCPPorts = [
    service_configs.ports.https
  ];

  networking.firewall.allowedUDPPorts = [
    service_configs.ports.https
  ];

  users.users.${username}.extraGroups = [
    config.services.caddy.group
  ];
}