{
	imports = [ ../../../common/services/nginx.nix ];
	services.nginx.virtualHosts = {
		"graven.dev" = {
			enableACME = true;
			forceSSL = true;
			locations."/".root = "/var/www/graven.dev/public";
			locations."~ ^/(client|_matrix/client/unstable/org.matrix.msc3575/sync)" = {
				proxyPass = "http://127.0.0.1:8009";
				priority = 900;
			};
			locations."~ ^(\\/_matrix|\\/_synapse\\/client)" = {
				proxyPass = "http://127.0.0.1:8008";
				priority = 1000;
			};
			locations."/.well-known/matrix/" = {
				root = "/var/www/matrix/public";
				extraConfig = ''
					default_type application/json;
					add_header Access-Control-Allow-Origin "*";
					add_header Strict-Transport-Security $hsts_header;
					add_header Referrer-Policy "same-origin";
					add_header X-Content-Type-Options "nosniff";
					add_header X-XSS-Protection "1; mode=block";
				'';
			};
		};
		"rss.graven.dev" = {
			enableACME = true;
			forceSSL = true;
		};
		"git.graven.dev" = {
			enableACME = true;
			forceSSL = true;
			locations."/".proxyPass = "http://unix:/run/gitea/gitea.sock:";
		};
		"vault.graven.dev" = {
			forceSSL = true;
			enableACME = true;
			locations."/" = {
				proxyPass = "http://localhost:8812";
				proxyWebsockets = true;
			};
			locations."/notifications/hub" = {
				proxyPass = "http://localhost:3012";
				proxyWebsockets = true;
			};
			locations."/notifications/hub/negotiate" = {
				proxyPass = "http://localhost:8812";
				proxyWebsockets = true;
			};
		};
		"openpgpkey.graven.dev" = {
			forceSSL = true;
			enableACME = true;
			locations."/" = {
				root = "/var/www/openpgpkey";
				extraConfig = ''
					default_type "application/octet-stream";
					add_header Access-Control-Allow-Origin "*";
					add_header Strict-Transport-Security $hsts_header;
					add_header Referrer-Policy "same-origin";
					add_header X-Frame-Options "DENY";
					add_header X-Content-Type-Options "nosniff";
					add_header X-XSS-Protection "1; mode=block";
				'';
			};
		};
		"openpgpkey.graven.se" = {
			forceSSL = true;
			enableACME = true;
			locations."/" = {
				root = "/var/www/openpgpkey";
				extraConfig = ''
					default_type "application/octet-stream";
					add_header Access-Control-Allow-Origin "*";
					add_header Strict-Transport-Security $hsts_header;
					add_header Referrer-Policy "same-origin";
					add_header X-Frame-Options "DENY";
					add_header X-Content-Type-Options "nosniff";
					add_header X-XSS-Protection "1; mode=block";
				'';
			};
		};
		"tor.graven.dev" = {
			forceSSL = true;
			enableACME = true;
			locations."/" = {
				root = "/var/www/tor";
				extraConfig = ''
					add_header Access-Control-Allow-Origin "*";
					add_header Strict-Transport-Security $hsts_header;
					add_header Referrer-Policy "same-origin";
					add_header X-Frame-Options "DENY";
					add_header X-Content-Type-Options "nosniff";
					add_header X-XSS-Protection "1; mode=block";
				'';
			};
		};
		"mta-sts.graven.dev" = {
			forceSSL = true;
			enableACME = true;
			root = "/var/www/mta-sts/public";
		};
		"mta-sts.graven.se" = {
			forceSSL = true;
			enableACME = true;
			root = "/var/www/mta-sts/public";
		};
		"mta-sts.nao.sh" = {
			forceSSL = true;
			enableACME = true;
			root = "/var/www/mta-sts/public";
		};
		"mta-sts.amandag.net" = {
			forceSSL = true;
			enableACME = true;
			root = "/var/www/mta-sts/public";
		};
		"mta-sts.queersin.space" = {
			forceSSL = true;
			enableACME = true;
			root = "/var/www/mta-sts/public";
		};
		"mta-sts.anarkafem.dev" = {
			forceSSL = true;
			enableACME = true;
			root = "/var/www/mta-sts/public";
		};
	};
}