{ config, pkgs, ... }:
{
  services.atticd = {
    enable = true;
    package = pkgs.attic-server;

    credentialsFile = "/run/secrets/services/attic/creds.env";

    settings = {
      listen = "0.0.0.0:28842";

      chunking = {
        nar-size-threshold = 64 * 1024; # 64 KiB
        min-size = 16 * 1024; # 16 KiB
        avg-size = 64 * 1024; # 64 KiB
        max-size = 256 * 1024; # 256 KiB
      };
    };
  };

  services.nginx.virtualHosts."attic.lewd.wtf" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:28842";
      extraConfig =
        "proxy_set_header        Host $host;" +
        "proxy_set_header        X-Real-IP $remote_addr;" +
        "proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;" +
        "proxy_set_header        X-Forwarded-Proto $scheme;" +
        "proxy_connect_timeout   1800;" +
        "proxy_send_timeout      1800;" +
        "proxy_read_timeout      1800;" +
        "send_timeout            1800;" +
        "client_max_body_size    5G;"
        ;
    };
  };
}