{ pkgs, ... }:

{
  systemd.tmpfiles.rules = [
    "d /opt 775 root root"
    "d /opt/garage 770 joe nginx"
  ];

  systemd.services.garage = {
    wantedBy = [ "multi-user.target" ];
    unitConfig = {
      AssertPathExists = "/opt/garage/serve.py";
    };
    serviceConfig = {
      WorkingDirectory = "/opt/garage";
      UMask = "002";
      User = "joe";
      Group = "nginx";
    };
    path = [ (pkgs.python3.withPackages (ps: [ ps.aiohttp ])) ];
    script = "exec python3 serve.py ./sock";
  };

  services.nginx.virtualHosts."ga.mou.fo" = {
    enableACME = true;
    forceSSL = true;
    locations."/".proxyPass = "http://unix:/opt/garage/sock";
  };
}