{
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.services.volpe;

  isOnion = domain: lib.hasSuffix ".onion" domain;

  mkPkg = domain: let
    protocol =
      if isOnion domain
      then "http"
      else "https";
  in
    pkgs.callPackage ./package.nix {
      siteUrl = "${protocol}://${domain}";
    };

  allDomains = [cfg.domain] ++ cfg.extraDomains;
  regularDomains = lib.filter (d: !(isOnion d)) allDomains;
  onionDomains = lib.filter isOnion cfg.extraDomains;

  mkHost = domain: {
    root = "${mkPkg domain}";
    locations."/" = {
      tryFiles = "$uri $uri/ /index.html";
    };
    locations."~* \\.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$" = {
      extraConfig = ''
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
        access_log off;
      '';
    };
  };

  mkVirtualHost = domain:
    {
      forceSSL = cfg.enableACME;
      enableACME = cfg.enableACME;
    }
    // (mkHost domain);

  mkOnionVirtualHost = domain:
    {
      listen = [
        {
          addr = "[::1]";
          port = 80;
        }
        {
          addr = "127.0.0.1";
          port = 80;
        }
      ];
    }
    // (mkHost domain);
in {
  options.services.volpe = {
    enable = lib.mkEnableOption "volpe blog";

    domain = lib.mkOption {
      type = lib.types.str;
      description = "Primary domain name for nginx virtual host.";
    };

    extraDomains = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = [];
      description = "Additional domain names, each gets its own virtualHost.";
    };

    enableACME = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = "Whether to enable ACME (Let's Encrypt) for SSL certificates.";
    };

    acmeEmail = lib.mkOption {
      type = lib.types.str;
      default = "";
      description = "Email address for ACME certificate registration.";
    };
  };

  config = lib.mkIf cfg.enable {
    services.nginx = {
      enable = true;
      recommendedTlsSettings = cfg.enableACME;
      recommendedOptimisation = true;
      recommendedGzipSettings = true;
      recommendedProxySettings = true;
      serverNamesHashBucketSize = 128;

      virtualHosts = lib.listToAttrs (
        (map (domain: {
            name = domain;
            value = mkVirtualHost domain;
          })
          regularDomains)
        ++ (map (domain: {
            name = domain;
            value = mkOnionVirtualHost domain;
          })
          onionDomains)
      );
    };

    security.acme = lib.mkIf cfg.enableACME {
      acceptTerms = true;
      defaults.email = cfg.acmeEmail;
    };

    networking.firewall.allowedTCPPorts = [80 443];
  };
}