{ truth-machine, ... }:
let
  domain = "truth.darkest.space";
in
{
  imports = [ truth-machine.nixosModules.default ];

  services = {
    truth-machine = {
      enable = true;
      virtualHost = domain;
      # ANTHROPIC_API_KEY, TRUTH_ADMIN_PASSWORD and TRUTH_ADMIN_PATH, placed manually
      environmentFile = "/etc/secrets/truth-machine.env";
    };

    nginx.virtualHosts.${domain} = {
      enableACME = true;
      forceSSL = true;
    };
  };
}