{ self, config, lib, pkgs, ... }: let
  inherit (lib) enabled merge mkIf mkOption types;
  inherit (config.networking) domain;
in {
  imports = [(self + /modules/nginx.nix)];
  options.cache = {
    enable = lib.mkEnableOption "nix-serve cache server";
    fqdn = lib.mkOption {
      type = types.str;
      example = "cache1.example.com";
      description = "Fully qualified domain name for the cache";
    };
    port = lib.mkOption {
      type = types.port;
      default = 8006;
      description = "Port for nix-serve to listen on";
    };
    secretKeyFile = lib.mkOption {
      type = types.path;
      example = "/run/agenix/nixServeKey";
      description = "Path to the secret key file for signing the cache";
    };
  };
  config = mkIf config.cache.enable {
    services.nix-serve = enabled {
      package = pkgs.nix-serve-ng;
      secretKeyFile = config.cache.secretKeyFile;
      bindAddress = "127.0.0.1";
      port = config.cache.port;
    };
    services.nginx.virtualHosts.${config.cache.fqdn} = merge config.services.nginx.sslTemplate {
      locations."= /".return = "301 https://${domain}/404";
      locations."/".proxyPass = "http://127.0.0.1:${toString config.cache.port}";
    };
  };
}

{ self, config, lib, pkgs, ... }: let
  inherit (config.networking) domain;
  inherit (lib) enabled merge;
  portNixServe = 8006;
in {
  imports = [(self + /modules/nginx.nix)];
  age.secrets.nixServeKey = {
    owner     = "root";
  };
  services.nix-serve = enabled {
    package = pkgs.nix-serve-ng;
    secretKeyFile = config.age.secrets.nixServeKey.path;
    bindAddress = "127.0.0.1";
    port = portNixServe;
  };
  services.nginx.virtualHosts.${fqdn} = merge config.services.nginx.sslTemplate {
    locations."= /".return = "301 https://${domain}/404";
    locations."/".proxyPass = "http://127.0.0.1:${toString portNixServe}";
  };
}
    rekeyFile = self + /secrets/plum-cache-key.age;
  fqdn = "cache1.${domain}";

          ./cache

          (self + /modules/cache.nix)

        age.secrets.nixServeKey = {
          rekeyFile = self + /secrets/plum-cache-key.age;
          owner     = "root";
        };
        cache = enabled {
          fqdn          = "cache1.${config.networking.domain}";
          secretKeyFile = config.age.secrets.nixServeKey.path;
        };

{ self, config, lib, pkgs, ... }: let
  inherit (lib) enabled merge;
  cacheDomain = "plumj.am";
  fqdn = "cache2.${cacheDomain}";
  portNixServe = 8007;
in {
  imports = [(self + /modules/nginx.nix)];
  age.secrets.nixServeKey = {
    owner     = "root";
  };
  services.nix-serve = enabled {
    package = pkgs.nix-serve-ng;
    secretKeyFile = config.age.secrets.nixServeKey.path;
    bindAddress = "127.0.0.1";
    port = portNixServe;
  };
  services.nginx.virtualHosts.${fqdn} = merge config.services.nginx.sslTemplate {
    locations."= /".return = "301 https://${cacheDomain}/404";
    locations."/".proxyPass = "http://127.0.0.1:${toString portNixServe}";
  };
}
    rekeyFile = self + /secrets/kiwi-cache-key.age;

          ./cache

          (self + /modules/cache.nix)

        age.secrets.nixServeKey = {
          rekeyFile = self + /secrets/kiwi-cache-key.age;
          owner     = "root";
        };
        cache = enabled {
          fqdn          = "cache2.plumj.am";
          secretKeyFile = config.age.secrets.nixServeKey.path;
        };