{
  flake,
  config,
  pkgs,
  lib,
  ...
}: {
  networking.firewall.allowedTCPPorts = [ 80 443 ];

  services.nginx = {
    enable = true;

    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedTlsSettings = true;
    recommendedProxySettings = true;

    defaultListenAddresses = [
      "192.168.178.3"
      "10.13.12.3"
      "[fd00:b12f:acab:1312:acab:3::]"
    ];
  };
}