{ config, ... }:
let
  srv = config.services.forgejo.settings.server;
  anubis-domain-socket = "/run/anubis/anubis-forge/anubis.sock";
  anubis-metrics-socket = "/run/anubis/anubis-forge/anubis-metrics.sock";
in
{
  security.acme = {
    acceptTerms = true;
    defaults.email = "acme@darkest.space";
  };

  systemd.services.nginx.serviceConfig.SupplementaryGroups = [ "anubis" ];

  services = {
    nginx = {
      enable = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;

      virtualHosts.${srv.DOMAIN} = {
        enableACME = true;
        forceSSL = true;
        extraConfig = ''
          client_max_body_size 512M;
        '';
        locations = {
          "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics";
          "/".proxyPass = "http://unix:" + anubis-domain-socket;
        };
      };
    };

    anubis.instances.forge = {
      enable = true;
      settings = {
        BIND = anubis-domain-socket;
        TARGET = "http://127.0.0.1:${toString srv.HTTP_PORT}";
        METRICS_BIND = anubis-metrics-socket;
      };
    };
  };

  networking.firewall.allowedTCPPorts = [
    80
    443
  ];
}