diff --git a/nextcloud.nix b/nextcloud.nix
index 692aaad..622b631 100644
--- a/nextcloud.nix
+++ b/nextcloud.nix
@@ -18,16 +18,6 @@
     hostName = "nextcloud.srazka.com";
     https = true;
 
-    # Let Caddy handle TLS termination; nginx only listens on localhost.
-    # The nextcloud module creates the virtualhost at hostName; we override
-    # its listen address here.
-    services.nginx.virtualHosts.${config.services.nextcloud.hostName}.listen = [
-      {
-        addr = "127.0.0.1";
-        port = 8081;
-      }
-    ];
-
     config = {
       adminuser = "admin";
       adminpassFile = config.age.secrets."nextcloud-admin-pass".path;
@@ -42,4 +32,14 @@
       default_phone_region = "NL";
     };
   };
+
+  # Let Caddy handle TLS termination; nginx only listens on localhost.
+  # The nextcloud module creates the virtualhost at hostName; we override
+  # its listen address here.
+  services.nginx.virtualHosts.${config.services.nextcloud.hostName}.listen = [
+    {
+      addr = "127.0.0.1";
+      port = 8081;
+    }
+  ];
 }