{ domain, ... }:
{ pkgs, lib, config, hostName, ... }:
let
  inherit (config) networking;
  inherit (config.security) gnupg;
  inherit (config.services) nginx nix-serve;
  inherit (config.users) users groups;
  srv = "nix-serve";
in
{
nix.trustedUsers = [ users."nix-serve".name ];
users.users."nix-serve" = {
  isSystemUser = true;
  group = groups."nix-serve".name;
  extraGroups = [ groups."keys".name ];
};
users.groups."nix-serve" = {};
security.gnupg.secrets."nix/binary-cache-key/1" = {
  user = users."nix-serve".name;
  systemdConfig = {
    before = [ "nix-serve.service" ];
    wantedBy = [ "nix-serve.service" ];
  };
};
services.nix-serve = {
  enable = true;
  secretKeyFile = gnupg.secrets."nix/binary-cache-key/1".path;
  bindAddress = "127.0.0.1";
};
services.nginx = let vhostConfig = priority:
  {
    extraConfig = ''
      #access_log /var/log/nginx/${domain}/${srv}/access.json json buffer=32k;
      #error_log  /var/log/nginx/${domain}/${srv}/error.log warn;
      access_log off;
      error_log  /dev/null crit;
    '';
    locations."/nix-cache-info" = {
      # cache.nixos.org has priority 40
      return = ''200 "StoreDir: ${builtins.storeDir}\nWantMassQuery: 1\nPriority: ${toString priority}\n"'';
      extraConfig = ''
        ${nginx.configs.https_add_headers}
        add_header Content-Type text/plain;
      '';
    };
    locations."/".extraConfig = ''
      proxy_pass http://localhost:${toString nix-serve.port};
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    '';
  };
  in {
  virtualHosts."nix-extracache.${domain}" = vhostConfig 60 // {
    serverAliases = [ "${srv}.${domain}" ];
    forceSSL = true;
    useACMEHost = domain;
  };
  virtualHosts."nix-localcache.${domain}" = vhostConfig 30 // {
    forceSSL = true;
    useACMEHost = domain;
  };
  # cache.nixos.org has priority over extracache
  virtualHosts."nix-extracache.${hostName}.wg" = vhostConfig 60 // {
    listenAddresses = [ "nix-extracache.${hostName}.wg" ];
    forceSSL = false;
  };
  # localcache has priority over cache.nixos.org
  virtualHosts."nix-localcache.${hostName}.wg" = vhostConfig 30 // {
    listenAddresses = [ "nix-localcache.${hostName}.wg" ];
    forceSSL = false;
  };
};
systemd.services.nginx = {
  serviceConfig = {
    LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];
  };
};
}