{config, ...}: {
  services.atuin = {
    enable = true;
    openRegistration = false;
    maxHistoryLength = 1024 * 16;
    port = 43473;
  };

  services.nginx.virtualHosts."atuin.winston.sh" = {
    forceSSL = true;
    enableACME = false;
    useACMEHost = "winston.sh";

    locations."/" = with config.services.atuin; {
      extraConfig =
        # nginx
        ''
          access_log /var/log/nginx/atuin.access.log combined_geoip;
        '';
      proxyPass = "http://${host}:${toString port}";
    };
  };
}