{
  lib,
  config,
  flake-inputs,
  pkgs,
  ...
}:
let
  domain = "foundryvtt.${config.services.nginx.domain}";
in
{
  imports = [ flake-inputs.foundryvtt.nixosModules.foundryvtt ];

  networking.firewall.allowedTCPPorts = [
    80
    443
  ];

  services = {
    foundryvtt = {
      enable = true;
      hostName = domain;
      minifyStaticFiles = true;
      proxySSL = true;
      proxyPort = 443;
      package = flake-inputs.foundryvtt.packages.${pkgs.system}.foundryvtt_13;
    };

    nginx.virtualHosts."${domain}" =
      let
        inherit (config.services.foundryvtt) port;
      in
      {
        forceSSL = true;
        useACMEHost = "tlater.net";
        enableHSTS = true;

        locations."/" = {
          proxyWebsockets = true;
          proxyPass = "http://localhost:${toString port}";
        };
      };

    backups.foundryvtt = {
      user = "foundryvtt";
      paths = [ config.services.foundryvtt.dataDir ];
      pauseServices = [ "foundryvtt.service" ];
    };
  };

  # Want to start it manually when I need it, not have it constantly
  # running
  systemd.services.foundryvtt.wantedBy = lib.mkForce [ ];
}
