{ ... }:
{
  services.caddy = {
    enable = true;
    email  = "admin@srazka.com";

    # Authelia's own login portal
    virtualHosts."auth.srazka.com".extraConfig = ''
      reverse_proxy 127.0.0.1:9091
    '';

    # Every protected site uses this snippet
    virtualHosts."hello.srazka.com".extraConfig = ''
      forward_auth 127.0.0.1:9091 {
        uri /api/authz/forward-auth
        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
      }
      reverse_proxy 192.168.100.11:80
    '';
  };
}