{
  flake,
  config,
  pkgs,
  lib,
  ...
}: {
  networking.firewall.allowedTCPPorts = [ 80 443 ];

  services.nginx = {
    enable = true;

    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedTlsSettings = true;
    recommendedProxySettings = true;

    defaultListenAddresses = [
      "192.168.178.2"
      # "2a02:908:5b1:e3c0:2::"
      "10.13.12.2"
      "[fd00:b12f:acab:1312:acab:2::]"
    ];
  };
}