{ config, pkgs, ... }:
{
  services.caddy = {
    enable = true;
    email  = "admin@reudy.net";

    # App routes generated by the panel are imported by its module (panel.nix).

    # Authelia's own login portal
    virtualHosts."auth.reudy.net".extraConfig = ''
      reverse_proxy 127.0.0.1:9091
    '';

    # Every protected site uses this snippet
    virtualHosts."hello.reudy.net".extraConfig = ''
      forward_auth 127.0.0.1:9091 {
        uri /api/authz/forward-auth
        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
      }
      reverse_proxy 192.168.100.11:80
    '';

    # Nextcloud — served by local nginx
    # (Authelia forward-auth disabled for now; re-enable by uncommenting the
    #  forward_auth block below.)
    virtualHosts."nextcloud.reudy.net".extraConfig = ''
      # forward_auth 127.0.0.1:9091 {
      #   uri /api/authz/forward-auth
      #   copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
      # }
      reverse_proxy 127.0.0.1:8081
    '';

    # Forgejo — no Authelia forward-auth, since it would break git over HTTPS
    # and the API. Forgejo handles its own logins.
    virtualHosts."git.reudy.net".extraConfig = ''
      reverse_proxy 127.0.0.1:14921
    '';
  };

}