{
  config,
  ...
}:
let
  ts-domain = "fin-marlin.ts.net";
in
{
  age.secrets.open-webui.file = ../../secrets/open-webui.age;

  services.open-webui = {
    enable = true;
    environment = {
      ANONYMIZED_TELEMETRY = "False";
      DO_NOT_TRACK = "True";
      ENABLE_VERSION_UPDATE_CHECK = "False";

      ENABLE_API_KEYS = "True";
      WEBUI_URL = "https://chat.${ts-domain}";
      WEBUI_AUTH_TRUSTED_EMAIL_HEADER = "X-Webauth-Email";
      WEBUI_AUTH_TRUSTED_NAME_HEADER = "X-Webauth-User";
      WEBUI_AUTH = "False";
      CORS_ALLOW_ORIGIN = "https://chat.${ts-domain}";

      OPENAI_API_BASE_URL = "https://openrouter.ai/api/vi";
    };
  };

  services.caddy.virtualHosts = {
    "chat.${ts-domain}" = {
      extraConfig = ''
        bind tailscale/chat
        tailscale_auth
        reverse_proxy localhost:${toString config.services.open-webui.port} {
          header_up X-Webauth-User {http.auth.user.tailscale_login}
          header_up X-Webauth-Email {http.auth.user.tailscale_user}
          header_up X-Webauth-Name {http.auth.user.tailscale_name}
        }
      '';
    };
  };
}