{
  flake,
  config,
  pkgs,
  lib,
  ...
}:
let
  psCfg = config.pub-solar;
  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in
{
  age.secrets.vikunja-secret-env = {
    file = "${flake.self}/secrets/vikunja-secret-env.age";
    mode = "400";
    owner = "vikunja";
  };

  security.acme.certs = {
    "viku.faenix.eu" = { };
  };

  services.nginx.virtualHosts = {
    "viku.faenix.eu" = {
      forceSSL = true;
      useACMEHost = "viku.faenix.eu";
      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.vikunja.port}";
    };
  };

  services.vikunja = {
    enable = true;
    frontendScheme = "https";
    frontendHostname = "viku.faenix.eu";
    environmentFiles = [ config.age.secrets."vikunja-secret-env".path ];
  };
}