{
  config,
  ...
}:
let
  domain = config.networking.domain;
  ts-domain = "fin-marlin.ts.net";
in
{
  age.secrets.readeck.file = ../../secrets/readeck.age;

  services.readeck = {
    enable = true;
    environmentFile = config.age.secrets.readeck.path;
    settings = {
      server = {
        host = "unix:/run/web/readeck.sock?mode=0660";
        base_url = "https://read.${ts-domain}";
      };
      email = {
        host = "localhost";
        port = 587;
        from = "readeck@${domain}";
        from_noreply = "noreply+readeck@${domain}";
      };
      auth.forwarded = {
        enabled = true;
        provisioning = false;
        header_user = "X-Webauth-User";
        header_email = "X-Webauth-Email";
      };
    };
  };

  services.caddy.virtualHosts = {
    "read.${ts-domain}" = {
      extraConfig = ''
        bind tailscale/read
        tls {
          get_certificate tailscale
        }
        tailscale_auth
        reverse_proxy {
          to unix//run/web/readeck.sock
          header_up X-Webauth-User {http.auth.user.tailscale_login}
          header_up X-Webauth-Email {http.auth.user.tailscale_user}
        }
      '';
    };
  };

  systemd.services.readeck.serviceConfig = {
    SupplementaryGroups = [ "webservice" ];
  };
}