{ config, ... }:

{
  users.users.nginx.extraGroups = [ "acme" ];

  services.nginx = {
    enable = true;
    resolver.addresses = [
      "[2606:4700:4700::1111]"
      "[2620:fe::fe]"
      "1.1.1.1"
      "9.9.9.9"
    ];
    statusPage = true; # http://127.0.0.1/nginx_status
    sslProtocols = "TLSv1.3";
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedBrotliSettings = true;
    commonHttpConfig = ''
      log_format vhost_combined '$host:$server_port $remote_addr - $remote_user [$time_local] '
        '"$request" $status $body_bytes_sent '
        '"$http_referer" "$http_user_agent"';

      map $remote_addr $proxy_forwarded_for_element {
        # IPv4 addresses can be sent as-is
        ~^[0-9.]+$          "for=\"$remote_addr:$remote_port\"";

        # IPv6 addresses need to be bracketed and quoted
        ~^[0-9A-Fa-f:.]+$   "for=\"[$remote_addr]:$remote_port\"";

        default             "for=unknown";
      }

      map $server_addr $proxy_forwarded_by_element {
        # IPv4 addresses can be sent as-is
        ~^[0-9.]+$        "by=\"$server_addr:$server_port\"";

        # IPv6 addresses need to be bracketed and quoted
        ~^[0-9A-Fa-f:.]+$ "by=\"[$server_addr]:$server_port\"";

        default           "by=unknown";
      }
    '';
  };
}