{
  config,
  service_configs,
  username,
  pkgs,
  ...
}:
let
  matrix_hostname = "matrix.${service_configs.https.domain}";
in
{
  services.caddy = {
    enable = true;
    email = "titaniumtown@proton.me";
    virtualHosts = {
      ${service_configs.https.domain} = {
        extraConfig = ''

          header /.well-known/matrix/* Content-Type application/json
          header /.well-known/matrix/* Access-Control-Allow-Origin *
          respond /.well-known/matrix/server `{"m.server": "${matrix_hostname}:443"}`
          respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${matrix_hostname}"},"m.homeserver":{"base_url":"https://${matrix_hostname}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-conduit.settings.global.server_name}"}}`

          root * ${service_configs.https.data_dir}
          file_server browse
        '';

        serverAliases = [ "www.${service_configs.https.domain}" ];
      };

      "immich.${service_configs.https.domain}".extraConfig = ''
        reverse_proxy :${builtins.toString config.services.immich.port}
      '';

      "jellyfin.${service_configs.https.domain}".extraConfig = ''
        reverse_proxy :${builtins.toString service_configs.ports.jellyfin}
        request_body {
        	max_size 4096MB
        }
      '';

      "${service_configs.gitea.domain}".extraConfig = ''
        reverse_proxy :${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
      '';

      "bitmagnet.${service_configs.https.domain}".extraConfig = ''
        # tls internal
        ${import ../secrets/caddy_auth.nix}
        reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
      '';

      "torrent.${service_configs.https.domain}".extraConfig = ''
        # tls internal
        ${import ../secrets/caddy_auth.nix}
        reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.torrent}
      '';

      "map.${service_configs.https.domain}".extraConfig = ''
        # tls internal
        root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
        file_server browse
      '';

      "${matrix_hostname}".extraConfig = ''
        reverse_proxy :${builtins.toString config.services.matrix-conduit.settings.global.port}
      '';

      # Exact duplicate of matrix.DOMAIN_NAME
      "${matrix_hostname}:8448".extraConfig =
        config.services.caddy.virtualHosts."${config.services.matrix-conduit.settings.global.server_name
        }".extraConfig;

      "owntracks.${service_configs.https.domain}".extraConfig = ''
        ${import ../secrets/owntracks_caddy_auth.nix}
        reverse_proxy :${builtins.toString service_configs.ports.owntracks}
      '';
    };
  };

  systemd.tmpfiles.rules = [
    "d ${service_configs.https.data_dir} 770 ${config.services.caddy.user} ${config.services.caddy.group}"
  ];

  systemd.packages = with pkgs; [ nssTools ];

  networking.firewall.allowedTCPPorts = [
    service_configs.ports.https

    # http (but really acmeCA challenges)
    80

    # for matrix federation
    8448
  ];

  networking.firewall.allowedUDPPorts = [
    service_configs.ports.https

    # for matrix federation
    8448
  ];

  users.users.${config.services.caddy.user}.extraGroups = [
    # for `map.gardling.com`
    "minecraft"
  ];

  users.users.${username}.extraGroups = [
    config.services.caddy.group
  ];
}