@@ -34,6 +34,7 @@ ../roles/server.nix
     ../roles/reverse-proxy.nix
     ../roles/binary-cache.nix
     ../roles/forgejo-runner.nix
+    ../roles/goatcounter.nix
     ../roles/searchix.nix
     ../roles/sso.nix
     ../settings/services/git-server.nix
@@ -292,25 +293,6 @@ # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
   system.stateVersion = "23.05"; # Did you read the comment?
 
-  services.goatcounter = {
-    enable = true;
-    address = "localhost";
-    port = 8082;
-    proxy = true;
-    extraArgs = [
-      "-db"
-      "sqlite3+db/goatcounter.sqlite3"
-      "-websocket"
-      "-automigrate"
-      "-email-from"
-      "goatcounter@${domain}"
-      "-smtp"
-      "smtp://localhost:25"
-      "-ratelimit"
-      "api-count:100/1"
-    ];
-  };
-
   services.powerdns =
     let
       inherit (lib.lists) flatten;
@@ -438,9 +420,6 @@ security.acme = {
     certs."${oldDomain}" = {
       extraDomainNames = [ "*.${oldDomain}" ];
     };
-    certs."stats.${domain}" = {
-      extraDomainNames = [ "*.stats.${domain}" ];
-    };
     certs."redis.${domain}" = {
       group = "redis-website";
       reloadServices = [ "redis-website" ];
@@ -482,17 +461,6 @@ }
               reverse_proxy ${srv.host}:${toString srv.port}
             '';
         };
-        "stats.${domain}" =
-          let
-            srv = config.services.goatcounter;
-          in
-          {
-            useACMEHost = "stats.${domain}";
-            serverAliases = [ "*.stats.${domain}" ];
-            extraConfig = ''
-              reverse_proxy ${srv.address}:${toString srv.port}
-            '';
-          };
         "go.${domain}" = {
           extraConfig = ''
             encode zstd gzip

@@ -0,0 +1,45 @@
+{
+  config,
+  ...
+}:
+let
+  domain = config.networking.domain;
+in
+{
+  services.goatcounter = {
+    enable = true;
+    address = "localhost";
+    port = 8082;
+    proxy = true;
+    extraArgs = [
+      "-db"
+      "sqlite3+db/goatcounter.sqlite3"
+      "-websocket"
+      "-automigrate"
+      "-email-from"
+      "goatcounter@${domain}"
+      "-smtp"
+      "smtp://localhost:25"
+      "-ratelimit"
+      "api-count:100/1"
+    ];
+  };
+
+  services.caddy.virtualHosts = {
+    "stats.${domain}" =
+      let
+        srv = config.services.goatcounter;
+      in
+      {
+        useACMEHost = "stats.${domain}";
+        serverAliases = [ "*.stats.${domain}" ];
+        extraConfig = ''
+          reverse_proxy ${srv.address}:${toString srv.port}
+        '';
+      };
+  };
+
+  security.acme.certs."stats.${domain}" = {
+    extraDomainNames = [ "*.stats.${domain}" ];
+  };
+}