tlaternet-server/configuration/services/webserver.nix

{config, ...}: {
  services.tlaternet-webserver.enable = true;

  # Set up SSL
  services.nginx.virtualHosts."${config.services.nginx.domain}" = let
    inherit (config.services.tlaternet-webserver.listen) addr port;
  in {
    forceSSL = true;
    enableACME = true;
    extraConfig = ''
      add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
    '';

    locations."/".proxyPass = "http://${addr}:${toString port}";
  };
}