{
  config,
  flake-inputs,
  ...
}: let
  domain = "foundryvtt.${config.services.nginx.domain}";
in {
  imports = [flake-inputs.foundryvtt.nixosModules.foundryvtt];

  services.foundryvtt = {
    enable = true;
    hostName = domain;
    minifyStaticFiles = true;
  };

  services.nginx.virtualHosts."${domain}" = let
    inherit (config.services.foundryvtt) port;
  in {
    forceSSL = true;
    enableACME = true;
    extraConfig = ''
      add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
    '';

    locations."/".proxyPass = "http://localhost:${toString port}";
  };
}