{ config, ... }:
{
  services.minio = {
    enable = true;
    browser = true;

    listenAddress = "127.0.0.1:14900";
    consoleAddress = "127.0.0.1:14901";

    region = "eu-central-1";
    rootCredentialsFile = config.age.secrets."services/minio/root-credentials".path;
  };

  systemd.services.minio.environment = {
    MINIO_BROWSER_REDIRECT = "true";
    MINIO_BROWSER_REDIRECT_URL = "https://minio.winston.sh";
  };

  services.nginx.virtualHosts = {
    "minio.winston.sh" = {
      forceSSL = true;
      enableACME = false;
      useACMEHost = "winston.sh";

      locations."/" = {
        proxyPass = "http://${config.services.minio.consoleAddress}";
      };
    };
    "s3.winston.sh" = {
      forceSSL = true;
      enableACME = false;
      useACMEHost = "winston.sh";

      locations."/" = {
        extraConfig =
          # nginx
          ''
            client_max_body_size 512M;
          '';
        proxyPass = "http://${config.services.minio.listenAddress}";
      };
    };
  };
}