{
  pkgs,
  hyperhive,
  hyperhive-website,
  ...
}:
let
  blog-domain-socket = "/run/nginx/blog.sock";
  anubis-domain-socket = "/run/anubis/anubis-main/anubis.sock";
  anubis-metrics-socket = "/run/anubis/anubis-main/anubis-metrics.sock";
in
{
  security.acme = {
    acceptTerms = true;
    defaults.email = "acme@zerforschen.plus";
  };

  systemd.tmpfiles.rules = [ "d /var/lib/hyperhive-media 0755 root root -" ];

  systemd.services = {
    nginx.serviceConfig.SupplementaryGroups = [ "anubis" ];
    anubis-main.serviceConfig.SupplementaryGroups = [ "nginx" ];
  };

  services = {
    nginx = {
      enable = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;

      virtualHosts = {
        "zerforschen.plus" = {
          addSSL = true;
          enableACME = true;
          locations = {
            "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics";
            "/".proxyPass = "http://unix:" + anubis-domain-socket;
          };
        };

        "blog-in-anubis" = {
          root = pkgs.zerforschen-plus-content;
          listen = [
            {
              addr = "unix:" + blog-domain-socket;
            }
          ];
        };

        "hyperhive.darkest.space" = {
          forceSSL = true;
          enableACME = true;
          root = hyperhive-website.packages.${pkgs.stdenv.hostPlatform.system}.default;
          # the site root is a store path (replaced every deploy), so large
          # media lives in its own dir, uploaded by hand:
          #   scp gource-hyperhive.webm root@hetzner-vpn2:/var/lib/hyperhive-media/
          locations."/media/".alias = "/var/lib/hyperhive-media/";
        };

        "trollhive.monster" = {
          forceSSL = true;
          enableACME = true;
          globalRedirect = "hyperhive.darkest.space";
        };
      };
    };

    anubis.instances.main = {
      enable = true;
      settings = {
        BIND = anubis-domain-socket;
        TARGET = "unix://" + blog-domain-socket;
        METRICS_BIND = anubis-metrics-socket;
      };
    };
  };

  networking.firewall.allowedTCPPorts = [
    80
    443
    5201
  ];
}