{ self, config, lib, ... }: let
  inherit (config.networking) domain;
  inherit (lib) enabled mkConst;
in {
  imports = [(self + /modules/acme)];
  options.services.caddy.sslTemplate = mkConst {
    useACMEHost = domain;
  };
  options.services.caddy.headers = mkConst /* caddy */ ''
    header {
      Access-Control-Allow-Origin {$allow_origin}
      Access-Control-Allow-Methods {$allow_methods}
      Strict-Transport-Security {$hsts_header}
      Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' ${domain} *.${domain}; object-src 'self' ${domain} *.${domain}; base-uri 'self';"
      Referrer-Policy "no-referrer"
      X-Frame-Options "DENY"
    }
  '';
  config.networking.firewall = {
    allowedTCPPorts = [ 443 80 ];
    allowedUDPPorts = [ 443 ];
  };
  config.services.caddy = enabled {
    globalConfig = /* caddy */ ''
      {
        admin 0.0.0.0:2019
      }
    '';
    extraConfig = /* caddy */ ''
      (hsts) {
        @https {
          scheme https
        }
        header @https Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"
      }
      (cors) {
        @cors_origin header Origin ~^https://(?:.+\.)?${domain}$
        @cors_methods {
          method OPTIONS
        }
        header @cors_origin {
          Access-Control-Allow-Origin {header.origin}
          Access-Control-Allow-Methods "CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT, TRACE"
        }
        respond @cors_methods "" 204
      }
    '';
  };
  config.security.acme.users = [ "caddy" ];
}
        header {
          Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"
          Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' ${domain} *.${domain}; object-src 'self' ${domain} *.${domain}; base-uri 'self';"
          Referrer-Policy "no-referrer"
          X-Frame-Options "DENY"
        }

{ self, config, lib, pkgs, ... }: let
  inherit (config.networking) domain;
  inherit (lib) enabled mkConst;
in {
  imports = [(self + /modules/acme)];
  options.services.nginx.sslTemplate = mkConst {
    forceSSL    = true;
    quic        = true;
    useACMEHost = domain;
  };
  options.services.nginx.headers = mkConst /* nginx */ ''
    proxy_hide_header Access-Control-Allow-Origin;
    add_header Access-Control-Allow-Origin $allow_origin always;
    ${config.services.nginx.headersNoAccessControlOrigin}
  '';
  options.services.nginx.headersNoAccessControlOrigin = mkConst /* nginx */ ''
    proxy_hide_header Access-Control-Allow-Methods;
    add_header Access-Control-Allow-Methods $allow_methods always;
    proxy_hide_header Strict-Transport-Security;
    add_header Strict-Transport-Security $hsts_header always;
    proxy_hide_header Content-Security-Policy;
    add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' ${domain} *.${domain}; object-src 'self' ${domain} *.${domain}; base-uri 'self';" always;
    proxy_hide_header Referrer-Policy;
    add_header Referrer-Policy no-referrer always;
    proxy_hide_header X-Frame-Options;
    add_header X-Frame-Options DENY always;
  '';
  config.networking.firewall = {
    allowedTCPPorts = [ 443 80 ];
    allowedUDPPorts = [ 443 ];
  };
  config.services.prometheus.exporters.nginx = enabled {
    listenAddress = "[::]";
  };
  config.security.acme.users = [ "nginx" ];
  config.services.nginx = enabled {
    package = pkgs.nginxQuic;
    statusPage = true;
    recommendedBrotliSettings = true;
    recommendedGzipSettings   = true;
    recommendedZstdSettings   = true;
    recommendedOptimisation   = true;
    recommendedProxySettings  = true;
    recommendedTlsSettings    = true;
    commonHttpConfig = /* nginx */ ''
      map $scheme $hsts_header {
        https "max-age=31536000; includeSubdomains; preload";
      }
      map $http_origin $allow_origin {
        ~^https://(?:.+\.)?${domain}$ $http_origin;
      }
      map $http_origin $allow_methods {
        ~^https://(?:.+\.)?${domain}$ "CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT, TRACE";
      }
      ${config.services.nginx.headers}
      proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
    '';
  };
}

    (self + /modules/caddy.nix)

    (self + /modules/nginx.nix)

  # caddy reverse proxy configuration
  services.caddy.virtualHosts.${fqdn} = {
    useACMEHost = domain;
    extraConfig = /* caddy */ ''
      reverse_proxy http://[::1]:${toString port}
      
      import cors
    '';

  # nginx reverse proxy configuration
  services.nginx.virtualHosts.${fqdn} = lib.merge config.services.nginx.sslTemplate {
    locations."/".proxyPass = "http://[::1]:${toString port}";