{
  pkgs,
  lib,
  config,
  ...
}: {
  services.caddy = {
    enable = true;
    openFirewall = true;
    environmentFile = "/run/secrets/caddy.env";
    package = pkgs.caddy.withPlugins {
      plugins = ["github.com/caddy-dns/cloudflare@v0.2.4"];
      hash = "sha256-7GoH8YLCoPmPExQxoga2FHB58zQDoZVf1BBwkVi0SsQ=";
    };
    globalConfig = ''
      email {$EMAIL}
      acme_dns cloudflare {$CLOUDFLARE} {
      	resolvers 1.1.1.1:53 1.0.0.1:53
      }
    '';
    # Public
    virtualHosts = {
      "nicknase27.com" = {
        extraConfig = ''
          # CORS headers for Matrix .well-known lookup
          @matrix path /.well-known/matrix/*
          header @matrix {
            Access-Control-Allow-Origin "*"
            Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
            Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
            Content-Type "application/json"
          }

          # Matrix Client & Server Delegation
          respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"https://nicknase27.com"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://rtc-jwt.nicknase27.com"}]}`
          respond /.well-known/matrix/server `{"m.server":"nicknase27.com:443"}`

          # Route Matrix API requests to Tuwunel
          reverse_proxy /_matrix/* localhost:6167

          # Root domain catch-all (disable tuwunel landing page text)
          respond / " " 200
        '';
      };
      # Reverse proxy for LiveKit JWT Service
      "rtc-jwt.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy localhost:8081
        '';
      };

      # Reverse proxy for LiveKit WebSocket / Signal API
      "matrix-rtc.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy localhost:7880
        '';
      };
      "nv.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy localhost:4533
        '';
        serverAliases = ["music.nicknase27.com"];
      };
      "vt.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy localhost:8222
        '';
        serverAliases = ["vault.nicknase27.com"];
      };
      "git.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy localhost:3000
        '';
      };
      "jf.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy storage.local:8096
        '';
        serverAliases = ["watch.nicknase27.com"];
      };

      # Local
      "opn.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy 10.0.0.1:80
        '';
      };
      "ui.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy https://localhost:11443 {
                   transport http {
                     tls_insecure_skip_verify
               }

           }

        '';
      };
      "home.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy localhost:8082
        '';
      };
      "torrent.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy localhost:9091
        '';
      };
      "storage.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy storage.local:80
        '';
      };
      "photos.nicknase27.com" = {
        extraConfig = ''
          reverse_proxy storage.local:2283
        '';
      };
    };
  };

  age.secrets.caddy = {
    file = ../../secrets/caddy.age;
    path = "/run/secrets/caddy.env";
    owner = "caddy";
    group = "caddy";
  };
}