{
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.services.volpe;
  pkg = pkgs.callPackage ./package.nix {};
in {
  options.services.volpe = {
    enable = lib.mkEnableOption "volpe blog";

    domain = lib.mkOption {
      type = lib.types.str;
      default = "localhost";
      description = "Primary domain name for nginx virtual host.";
    };

    extraDomains = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = [];
      description = "Additional domain names (aliases) for the virtual host.";
    };

    enableACME = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = "Whether to enable ACME (Let's Encrypt) for SSL certificates.";
    };

    acmeEmail = lib.mkOption {
      type = lib.types.str;
      default = "";
      description = "Email address for ACME certificate registration.";
    };
  };

  config = lib.mkIf cfg.enable {
    services.nginx = {
      enable = true;
      recommendedTlsSettings = cfg.enableACME;
      recommendedOptimisation = true;
      recommendedGzipSettings = true;
      recommendedProxySettings = true;

      virtualHosts.${cfg.domain} = {
        root = "${pkg}";
        serverAliases = cfg.extraDomains;
        forceSSL = cfg.enableACME;
        enableACME = cfg.enableACME;
        locations."/" = {
          tryFiles = "$uri $uri/ /index.html";
        };
      };
    };

    security.acme = lib.mkIf cfg.enableACME {
      acceptTerms = true;
      defaults.email = cfg.acmeEmail;
    };

    networking.firewall.allowedTCPPorts = [80 443];
  };
}