{ config, pkgs, lib, ... }:

lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {

  services.nginx = {
    enable = true;
    virtualHosts = {
      "${config.HostName}-vault" = {
        listen = [
          { addr = "0.0.0.0"; port = 8000; }
        ];

        locations."/" = {
          proxyPass = "http://127.0.0.1:8222";
          extraConfig = ''
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
          '';
        };
      };

      "${config.HostName}-roundcube" = {
        listen = [
          { addr = "0.0.0.0"; port = 1984; }
        ];

        root = "${pkgs.roundcube}/public_html";

        locations."/" = {
          extraConfig = ''
            index index.php index.html;
            try_files $uri $uri/ /index.php?$args;
          '';
        };

        locations."~ \\.php$" = {
          extraConfig = ''
            include ${pkgs.nginx}/conf/fastcgi_params;
            fastcgi_pass unix:/run/phpfpm/roundcube.sock;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
          '';
        };
      };
    };
  };


  networking.firewall.allowedTCPPorts = [ 1984 8000 ];
}