{
  caddy-plugins,
  pkgs,
  config,
  ...
}: let
  inherit (config.vars) mainUser;
  inherit (config.sops) secrets;

  caddy = caddy-plugins.packages.${pkgs.system}.default;

  clusterIP = config.services.pacemaker.virtualIps.caddy-vip.ip;
in {
  imports = [caddy-plugins.nixosModules.default];

  # User stuff
  environment.systemPackages = [caddy];
  users.users.${mainUser}.extraGroups = ["caddy"];

  systemd.services.caddy.serviceConfig = {
    EnvironmentFile = secrets.caddy-cloudflare.path;

    # For some reason the service
    # doesn't shutdown normally
    KillSignal = "SIGKILL";
    RestartKillSignal = "SIGKILL";
  };

  services.caddy = {
    enable = true;
    enableReload = false;
    package = caddy;

    virtualHosts = let
      dockerIP = "10.0.0.122";
      jellyIP = "10.0.0.123";
      servivi = "10.0.0.249";
    in {
      "nelim.org" = {
        serverAliases = ["*.nelim.org"];
        extraConfig = ''
           tls {
             dns cloudflare {$CLOUDFLARE_API_TOKEN}
             resolvers 1.0.0.1
          }
        '';

        subDomains = {
          # Misc one-liners
          vault.reverseProxy = "${dockerIP}:8781";
          hauk.reverseProxy = "${dockerIP}:3003";
          headscale.reverseProxy = "${clusterIP}:8085";
          jelly.reverseProxy = "${jellyIP}:80";

          # Resume builder
          resume.reverseProxy = "${dockerIP}:3060";
          resauth.reverseProxy = "${dockerIP}:3100";

          # Nextcloud & Co
          office.reverseProxy = "http://${dockerIP}:8055";
          nextcloud = {
            subDomainName = "cloud";
            extraConfig = ''
              redir /.well-known/carddav /remote.php/dav 301
              redir /.well-known/caldav /remote.php/dav 301
              redir /.well-known/webfinger /index.php/.well-known/webfinger 301
              redir /.well-known/nodeinfo /index.php/.well-known/nodeinfo 301
            '';
            reverseProxy = "${dockerIP}:8042";
          };

          forgejo = {
            subDomainName = "git";
            reverseProxy = "${servivi}:3000";
          };

          nix-binary-cache = {
            subDomainName = "cache";
            reverseProxy = "${servivi}:5000";
          };

          calibre = {
            subDomainName = "books";
            reverseProxy = "${dockerIP}:8083";
          };

          immich = {
            subDomainName = "photos";
            reverseProxy = "${dockerIP}:2283";
          };

          # FreshRSS & Co
          drss.reverseProxy = "${dockerIP}:3007";
          freshrss = {
            subDomainName = "rss";
            reverseProxy = "${dockerIP}:2800";
          };

          jellyseer = {
            subDomainName = "seerr";
            reverseProxy = "${dockerIP}:5055";
          };

          games.reverseProxy = "${dockerIP}:8074";

          # FIXME: what's the IP?
          #wgui.extraConfig = ''
          #  reverse_proxy ???:51821
          #'';

          lan = {
            reverseProxy = "${dockerIP}:3020";
            extraConfig = ''
              redir /index.html /
            '';

            subDirectories = {
              bazarr.reverseProxy = "${dockerIP}:6767";
              bazarr-french = {
                subDirName = "bafrr";
                reverseProxy = "${dockerIP}:6766";
              };

              prowlarr.reverseProxy = "${dockerIP}:9696";
              radarr.reverseProxy = "${dockerIP}:7878";
              sabnzbd.reverseProxy = "${dockerIP}:8382";
              sonarr.reverseProxy = "${dockerIP}:8989";

              calibre = {
                experimental = true;
                reverseProxy = "${dockerIP}:8580";
              };

              qbittorent = {
                subDirName = "qbt";
                experimental = true;
                reverseProxy = "10.0.0.128:8080";
              };

              vaultwarden = {
                subDirName = "vault";
                experimental = true;
                reverseProxy = "${dockerIP}:8780";
              };
            };
          };

          # Top secret Business
          joal.extraConfig = ''
            route {
              rewrite * /joal/ui{uri}
              reverse_proxy * ${dockerIP}:5656
            }
          '';
          joalws.extraConfig = ''
            route {
              reverse_proxy ${dockerIP}:5656
            }
          '';
        };
      };
    };
  };
}