{ ... }:
{
  systemd.tmpfiles.rules = [
    "f /run/agenix/etebase 0600 etebase-server wiki -"
  ];

  services = {
    etebase-server = {
      enable = true;
      port = 37358;
      dataDir = "/var/lib/etebase";
      settings = {
        global.secret_file = "/run/agenix/etebase";
        allowed_hosts = {
          allowed_host1 = "0.0.0.0";
          allowed_host2 = "etesync.bhankas.org";
        };
        global = {
          debug = true;
          media_root = "/var/lib/etesync";
        };
      };
    };

    nginx = {
      enable = true;
      virtualHosts = {
        "etesync.bhankas.org" = {
          addSSL = true;
          enableACME = true;
          locations."/" = {
            proxyPass = "http://127.0.0.1:37358";
            proxyWebsockets = false;
            extraConfig =
              "proxy_set_header Host $host;"
            ;
          };
        };
      };
    };
  };

  security.acme = {
    acceptTerms = true;
    certs = {
      "etesync.bhankas.org" = {
        email = "admin@bhankas.org";
        dnsResolver = "1.1.1.1:53";
      };
    };
  };
}