{
  flake,
  config,
  pkgs,
  lib,
  ...
}: {
  security.acme.certs = {
    "auth.b12f.io" = {};
  };

  services.nginx.virtualHosts."auth.b12f.io" = {
    forceSSL = true;
    useACMEHost = "auth.b12f.io";
    locations."/".proxyPass = "https://auth.b12f.io";
  };
}