{
  config,
  pkgs,
  ...
}:
let
  ns = config.services.nix-serve;
in
{
  age.secrets.binarycache.file = ../../secrets/binarycache.age;

  services.nix-serve = {
    enable = true;
    package = pkgs.nix-serve-ng;
    secretKeyFile = config.age.secrets.binarycache.path;
  };

  services.caddy.virtualHosts."binarycache.${config.networking.domain}" = {
    extraConfig = ''
      reverse_proxy ${ns.bindAddress}:${toString ns.port}
    '';
  };
}