{ config, pkgs, ... }:
let
  snakeoilCert = pkgs.runCommand "nginx-snakeoil-cert" { buildInputs = [ pkgs.openssl ]; } ''
    mkdir "$out"
    openssl req -newkey rsa:4096 -x509 -sha256 -days 36500 -subj '/CN=Snakeoil CA' -nodes -out "$out/cert.pem" -keyout "$out/cert.key"
  '';
in
{
  services.nginx = {
    enable = true;
    package = pkgs.nginxMainline;

    recommendedBrotliSettings = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    recommendedZstdSettings = true;

    # https://github.com/NixOS/nixpkgs/issues/180980#issuecomment-1179723811
    virtualHosts = {
      "defaultDummy404" = {
        default = true;
        serverName = "_";
        locations."/".extraConfig = "return 444;";
        locations."/.well-known/acme-challenge".root = "/var/lib/acme/acme-challenge";
      };
      "defaultDummy404ssl" = {
        default = true;
        serverName = "_";
        locations."/".extraConfig = "return 444;";
        locations."/.well-known/acme-challenge".root = "/var/lib/acme/acme-challenge";
        # Dummy SSL config
        onlySSL = true;
        sslCertificate = "${snakeoilCert}/cert.pem";
        sslCertificateKey = "${snakeoilCert}/cert.key";
      };
    };

    sslDhparam = config.security.dhparams.params.nginx.path;
  };

  security.dhparams = {
    enable = true;
    params.nginx = { };
  };

  networking.firewall.allowedTCPPorts = [
    80
    443
  ];

  # allow nginx to access Acme secrets
  users.users.nginx.extraGroups = [ "acme" ];
}