{
  config,
  lib,
  ...
}:
{
  services.tailscale.permitCertUid = config.services.caddy.user;

  security.acme.defaults.reloadServices = [ "caddy" ];
  users.groups.acme.members = [ "caddy" ];

  services.caddy = {
    enable = true;
    openFirewall = true;
    group = "caddy";
    virtualHosts = {
      "http://" = {
        # Needed for HTTP->HTTPS servers
      };
      "${config.networking.fqdn}" = {
        serverAliases = [ "https://" ];
        extraConfig = lib.mkDefault ''
          respond * 204
        '';
      };
    };
  };
  systemd.services.caddy.serviceConfig = {
    UMask = "007";
  };
}