{
  config,
  pkgs,
  ...
}:
let
  ns = config.services.nix-serve;
in
{
  age.secrets.binarycache.file = ../../secrets/binarycache.age;

  services.nix-serve = {
    enable = true;
    package = pkgs.nix-serve-ng;
    secretKeyFile = config.age.secrets.binarycache.path;
  };

  services.caddy.virtualHosts."binarycache.${config.networking.domain}" = {
    extraConfig = ''
      reverse_proxy ${ns.bindAddress}:${toString ns.port}
    '';
  };

  users.users.nixremote.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIy9jFioBvV0JA0lc+De2N+vDOABGHgCECW6vkD33CE4 sourcehut"
  ];
}