{config, ...}: {
  services.freshrss = rec {
    enable = true;

    baseUrl = "https://${virtualHost}";
    virtualHost = "rss.winston.sh";

    defaultUser = "winston";
    passwordFile = config.age.secrets."services/freshrss/admin-credentials".path;
  };

  age.secrets."services/freshrss/admin-credentials".owner = "freshrss";

  services.nginx.virtualHosts."${config.services.freshrss.virtualHost}" = {
    forceSSL = true;
    enableACME = false;
    useACMEHost = "winston.sh";
  };
}