{
  flake,
  config,
  pkgs,
  lib,
  ...
}: {
  networking.firewall.allowedTCPPorts = [ 80 443 ];

  services.nginx = {
    enable = true;

    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedTlsSettings = true;
    recommendedProxySettings = true;

    defaultListenAddresses = [
      "10.13.12.7"
      "[fd00:b12f:acab:1312:acab:7::]"
      "128.140.109.213"
      "[2a01:4f8:c2c:b60::]"
    ];
  };
}