{ lib, ... }:

{
  services.miniflux = {
    enable = true;
    config = {
      BASE_URL = "https://mf.mou.fo";
      CREATE_ADMIN = 0;
      LISTEN_ADDR = "/run/miniflux/miniflux.sock";
    };
  };

  # https://github.com/NixOS/nixpkgs/issues/177284
  systemd.services.miniflux.serviceConfig.RuntimeDirectoryMode = lib.mkForce "0755";

  services.nginx.virtualHosts."mf.mou.fo" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://unix:/run/miniflux/miniflux.sock";
    };
  };

  # TODO services.oauth2-proxy.nginx.virtualHosts = { "mf.mou.fo" = {}; };
}