{
  config,
  ...
}:
{
  age.secrets.ntfy.file = ../../secrets/ntfy.age;

  services.ntfy-sh = {
    enable = true;
    settings = {
      base-url = "https://ntfy.alin.ovh";
      behind-proxy = true;
      upstream-base-url = "https://ntfy.sh";
      auth-default-access = "deny";
      enable-login = true;
      require-login = true;
    };
    environmentFile = config.age.secrets.ntfy.path;
  };

  services.caddy.virtualHosts = {
    "ntfy.${config.networking.domain}" = {
      extraConfig = ''
        reverse_proxy ${config.services.ntfy-sh.settings.listen-http}
      '';
    };
  };
}