{
  config,
  ...
}:
let
  inherit (config.networking) hostName domain;
in
{
  services.caddy = {
    enable = true;
    globalConfig = ''
      pki {
        ca home {
          name "Home CA"
        }
      }
    '';
    virtualHosts = {
      "${hostName}.${domain}" = {
        extraConfig = ''
          tls {
            issuer internal {
              ca home
            }
          }
        '';
      };
      "ca.${domain}" = {
        # cd /var/lib/caddy && install -D -m 444 .local/share/caddy/pki/authorities/home/root.crt ca/root.crt
        serverAliases = [ "http://ca.${domain}" ];
        extraConfig = ''
          tls {
            issuer internal {
              ca home
            }
          }
          acme_server {
            allow {
              domains *.test *.${domain}
            }
          }
          root /var/lib/caddy/ca
          file_server browse
        '';
      };
    };
  };

  services.dnsmasq.settings.cname = [
    "ca.${domain},${hostName}.${domain}"
  ];
}