{
  config,
  lib,
  ...
}:
let
  inherit (import ../../lib/caddy.nix { inherit lib; }) security-headers;
  domain = config.networking.domain;
in
{
  services.caddy = {
    virtualHosts = {
      "files.${domain}" = {
        extraConfig = ''
          encode zstd gzip
          ${security-headers { }}
          root * /srv/http/files
          file_server browse
        '';
      };
    };
  };
}