{ pkgs, flakes, ... }:
{
  services.nginx = {
    virtualHosts."harmonica.donsz.nl" = {
      forceSSL = true;
      http2 = true;
      enableACME = true;

      locations."/" = {
        proxyPass = "http://[::1]:42424";
      };
    };
  };

  systemd.services.harmonica-tabs = {
    description = "harmonica tabs";

    wantedBy = [ "multi-user.target" ];
    after = [ "network.target" ];
    restartIfChanged = true;

    serviceConfig = {
      DynamicUser = true;
      ExecStart = "${flakes.harmonica.packages.${pkgs.system}.default}/bin/services";
      WorkingDirectory = "${flakes.harmonica.packages.${pkgs.system}.default}";
      Restart = "always";
    };
  };
}