{
  config,
  ...
}:
let
  domain = config.networking.domain;
in
{
  services.goatcounter = {
    enable = true;
    address = "localhost";
    port = 8082;
    proxy = true;
    extraArgs = [
      "-db"
      "sqlite3+db/goatcounter.sqlite3"
      "-websocket"
      "-automigrate"
      "-email-from"
      "goatcounter@${domain}"
      "-smtp"
      "smtp://localhost:25"
      "-ratelimit"
      "api-count:100/1"
    ];
  };

  services.caddy.virtualHosts = {
    "stats.${domain}" =
      let
        srv = config.services.goatcounter;
      in
      {
        useACMEHost = "stats.${domain}";
        serverAliases = [ "*.stats.${domain}" ];
        extraConfig = ''
          reverse_proxy ${srv.address}:${toString srv.port}
        '';
      };
  };

  security.acme.certs."stats.${domain}" = {
    extraDomainNames = [ "*.stats.${domain}" ];
  };
}