{
  config,
  pkgs,
  ...
}: {
  age.secrets."services/nextcloud/admin-password".owner = "nextcloud";

  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud29;

    hostName = "cloud.winston.sh";
    https = true;

    phpOptions = {
      "opcache.interned_strings_buffer" = "23";
    };

    extraApps = {
      inherit
        (config.services.nextcloud.package.packages.apps)
        end_to_end_encryption
        previewgenerator
        twofactor_webauthn
        ;
    };
    extraAppsEnable = true;

    config.adminpassFile = config.age.secrets."services/nextcloud/admin-password".path;
  };

  services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
    forceSSL = true;
    enableACME = false;
    useACMEHost = "winston.sh";
  };
}