{
  flake,
  config,
  pkgs,
  lib,
  ...
}: {
  security.acme.certs = {
    "media.b12f.io" = {};
  };

  services.nginx.virtualHosts."media.b12f.io" = {
    forceSSL = true;
    useACMEHost = "media.b12f.io";
    locations."/".proxyPass = "https://media.b12f.io";
  };
}