{ ... }:

{
  services.miniflux = {
    enable = true;
    config = {
      BASE_URL = "https://mf.mou.fo";
      CREATE_ADMIN = 0;
    };
  };

  # https://github.com/miniflux/website/blob/main/content/docs/howto.md#systemd-socket-activation
  systemd.sockets.miniflux = {
    wantedBy = [ "sockets.target" ];
    socketConfig = {
      ListenStream = "/run/miniflux.sock";
      SocketGroup = "nginx";
      SocketMode = "0660";
      NoDelay = true;
    };
  };

  systemd.services.miniflux.serviceConfig.NonBlocking = true;

  services.nginx.virtualHosts."mf.mou.fo" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://unix:/run/miniflux.sock";
    };
  };

  # TODO services.oauth2-proxy.nginx.virtualHosts = { "mf.mou.fo" = {}; };
}