{
  inputs,
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.services.caddy;
  wg-ip = "100.64.0.6";

  vw = {
    domain = config.services.vaultwarden.domain;
    port = config.services.vaultwarden.config.ROCKET_PORT;
  };
  navidrome = {
    domain = "music.sorre.internal";
    port = config.services.navidrome.settings.Port;
  };
  kanboard = {
    domain = config.services.kanboard.domain;
    socket = config.services.phpfpm.pools.kanboard.socket;
    package = config.services.kanboard.package;
  };
  cgitInternal = {
    domain = config.services.cgit.internal.nginx.virtualHost;
    port = 1923;
  };
  kanidm = {
    domain = config.services.kanidm.server.settings.domain;
    port = 8443;
  };
  blog.port = 7291;

  tls-config = "tls {$CREDENTIALS_DIRECTORY}/sorre.internal.crt {$CREDENTIALS_DIRECTORY}/sorre.internal.key";
in
{
  networking.firewall.allowedTCPPorts = [ blog.port ];

  services.caddy = {
    enable = true;
    virtualHosts = {
      "${vw.domain}" = {
        listenAddresses = [ wg-ip ];
        extraConfig = ''
          ${tls-config}

          reverse_proxy :${toString vw.port} {
            header_up True-Client-IP {remote_host}
            header_up X-Real-IP {remote_host}
          }
        '';
      };

      "${navidrome.domain}" = {
        listenAddresses = [ wg-ip ];
        extraConfig = ''
          ${tls-config}

          reverse_proxy :${toString navidrome.port} {
            header_up True-Client-IP {remote_host}
            header_up X-Real-IP {remote_host}
            flush_interval -1
          }
        '';
      };

      "http://sorre.xyz:${toString blog.port}" = {
        listenAddresses = [ wg-ip ];
        extraConfig = ''
          root ${inputs.sorre-website.packages.${pkgs.system}.default}
          file_server
        '';
      };

      "${kanboard.domain}" = {
        listenAddresses = [ wg-ip ];
        extraConfig = ''
          ${tls-config}

          root ${kanboard.package}/share/kanboard
          php_fastcgi unix/${kanboard.socket}
          file_server

          @assets path *.js *.css *.ttf *.woff *.woff2 *.png *.jpg *.jpeg *.svg
          header @assets {
            Cache-Control "public, max-age=15778463"
            X-Content-Type-Options "nosniff"
            X-Robots-Tag "none"
            X-Download-Options "noopen"
            X-Permitted-Cross-Domain-Policies "none"
            Referrer-Policy "no-referrer"
          }
        '';
      };

      "${cgitInternal.domain}" = {
        listenAddresses = [ wg-ip ];
        extraConfig = ''
          ${tls-config}

          reverse_proxy :${toString cgitInternal.port} {
            header_up True-Client-IP {remote_host}
            header_up X-Real-IP {remote_host}
          }
        '';
      };

      "${kanidm.domain}" = lib.mkIf config.services.kanidm.server.enable {
        listenAddresses = [ wg-ip ];
        extraConfig = ''
          reverse_proxy :${toString kanidm.port} {
            header_up True-Client-IP {remote_host}
            header_up X-Real-IP {remote_host}
          }
        '';
      };
    };
  };

  systemd.services.caddy = lib.mkIf cfg.enable {
    preStart = ''
      echo "Credentials directory: $CREDENTIALS_DIRECTORY" >&2
      if [ ! -d "$CREDENTIALS_DIRECTORY" ]; then
        echo "Credentials dir not found!" >&2
        exit 1
      fi
    '';
    serviceConfig.LoadCredential = [
      "sorre.internal.crt:/var/lib/secrets/certs/sorre.internal.crt"
      "sorre.internal.key:/var/lib/secrets/certs/sorre.internal.key"
    ];
  };
}