{ config, ... }:
{
  networking.firewall.allowedTCPPorts = [ 80 443 ];

  users.users.nginx.extraGroups = [ config.users.groups.keys.name ];

  services.nginx = {
    enable = true;
    virtualHosts."kinda.sus.lol" = {
      serverName = "kinda.sus.lol";
      locations = {
        "/music" = {
          extraConfig = ''
            proxy_pass http://127.0.0.1:4533;
            proxy_read_timeout 900;
            proxy_connect_timeout 900;
            proxy_send_timeout 900;
            send_timeout 900;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $http_connection;
          '';
        };
        "/lms" = {
          extraConfig = ''
            proxy_pass http://127.0.0.1:5082;
            proxy_read_timeout 900;
            proxy_connect_timeout 900;
            proxy_send_timeout 900;
            send_timeout 900;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $http_connection;
          '';
        };
        "/admin/sonarr" = {
          extraConfig = ''
            auth_basic "Show slit";
            auth_basic_user_file /run/secrets/services/nginx/admin.htpasswd;
            proxy_pass http://127.0.0.1:8989;
            proxy_read_timeout 900;
            proxy_connect_timeout 900;
            proxy_send_timeout 900;
            send_timeout 900;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $http_connection;
          '';
        };
        "/admin/radarr" = {
          extraConfig = ''
            auth_basic "Show slit";
            auth_basic_user_file /run/secrets/services/nginx/admin.htpasswd;
            proxy_pass http://127.0.0.1:7878;
            proxy_read_timeout 900;
            proxy_connect_timeout 900;
            proxy_send_timeout 900;
            send_timeout 900;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $http_connection;
          '';
        };
        "/admin/lidarr" = {
          extraConfig = ''
            auth_basic "Show slit";
            auth_basic_user_file /run/secrets/services/nginx/admin.htpasswd;
            proxy_pass http://127.0.0.1:8686;
            proxy_read_timeout 900;
            proxy_connect_timeout 900;
            proxy_send_timeout 900;
            send_timeout 900;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $http_connection;
          '';
        };
        "/admin/deemix" = {
          extraConfig = ''
            auth_basic "Show slit";
            auth_basic_user_file /run/secrets/services/nginx/admin.htpasswd;
            proxy_pass http://127.0.0.1:6595;
            proxy_read_timeout 900;
            proxy_connect_timeout 900;
            proxy_send_timeout 900;
            send_timeout 900;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $http_connection;
          '';
        };
        "/admin/prowlarr" = {
          extraConfig = ''
            auth_basic "Show slit";
            auth_basic_user_file /run/secrets/services/nginx/admin.htpasswd;
            proxy_pass http://127.0.0.1:9696;
            proxy_read_timeout 900;
            proxy_connect_timeout 900;
            proxy_send_timeout 900;
            send_timeout 900;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $http_connection;
          '';
        };
      };
    };
  };
}