{config, ...}: {
  services.nginx.virtualHosts.${config.services.gitlab.host} = {
    forceSSL = true;
    enableACME = false;
    useACMEHost = "winston.sh";

    locations."/" = {
      extraConfig = "client_max_body_size 512M;";
      proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
    };
  };
}