{ config, ... }:
let
  headscale = {
    domain = config.services.headscale.address;
    port = config.services.headscale.port;
  };

  simpleProxies = {
    "sorre.xyz" = "tower.sorre.internal:7291";
    "git.sorre.xyz" = "tower.sorre.internal:8721";
    "idm.sorre.xyz" = "tower.sorre.internal:8443";
  };

  simpleProxyVirtualHosts = builtins.mapAttrs (domain: upstream: {
    extraConfig = ''
      reverse_proxy ${upstream} {
        header_up True-Client-IP {remote_host}
        header_up X-Real-IP {remote_host}
      }
    '';
  }) simpleProxies;
in
{
  services.caddy = {
    enable = true;
    openFirewall = true;
    virtualHosts = {
      "http://headscale.sorre.xyz".extraConfig = ''
        handle /generate_204 {
          respond 204
        }

        handle * {
          redir https://{host}{uri}
        }
      '';
      "headscale.sorre.xyz".extraConfig = ''
        reverse_proxy ${headscale.domain}:${toString headscale.port} {
          header_up True-Client-IP {remote_host}
          header_up X-Real-IP {remote_host}
        }
      '';
      "vaultwarden.sorre.xyz".extraConfig = ''
        tls {
          client_auth {
            mode require_and_verify
            trust_pool file {
              pem_file ${../../etc/certs/rootCA.crt}
            }
          }
        }

        reverse_proxy https://vaultwarden.sorre.internal:443 {
          header_up True-Client-IP {remote_host}
          header_up X-Real-IP {remote_host}
        }
      '';
    }
    // simpleProxyVirtualHosts;
  };
}