{config, ...}: let
  cfg = config.services.matrix-conduit;
  domain = "matrix.${config.services.nginx.domain}";
  turn-realm = "turn.${config.services.nginx.domain}";
in {
  services.matrix-conduit = {
    enable = true;
    settings.global = {
      address = "127.0.0.1";
      server_name = domain;
      database_backend = "rocksdb";

      turn_uris = ["turn:turn.tlater.net?transport=udp" "turn:turn.tlater.net?transport=tcp"];
    };
  };

  # Pass in the TURN secret via EnvironmentFile, not supported by
  # upstream module currently.
  #
  # See also https://gitlab.com/famedly/conduit/-/issues/314
  systemd.services.conduit.serviceConfig.EnvironmentFile = config.sops.secrets."turn/env".path;

  services.coturn = {
    enable = true;
    use-auth-secret = true;
    static-auth-secret-file = config.sops.secrets."turn/secret".path;
    realm = turn-realm;

    # Based on suggestions from https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md
    no-tcp-relay = true;
    extraConfig = ''
      denied-peer-ip=0.0.0.0-0.255.255.255
      denied-peer-ip=100.64.0.0-100.127.255.255
      denied-peer-ip=127.0.0.0-127.255.255.255
      denied-peer-ip=169.254.0.0-169.254.255.255
      denied-peer-ip=192.0.0.0-192.0.0.255
      denied-peer-ip=192.0.2.0-192.0.2.255
      denied-peer-ip=192.88.99.0-192.88.99.255
      denied-peer-ip=198.18.0.0-198.19.255.255
      denied-peer-ip=198.51.100.0-198.51.100.255
      denied-peer-ip=203.0.113.0-203.0.113.255
      denied-peer-ip=240.0.0.0-255.255.255.255
      allowed-peer-ip=127.0.0.1
      user-quota=12
      total-quota=36
    '';
  };

  services.nginx.virtualHosts."${domain}" = {
    enableACME = true;

    listen = [
      {
        addr = "0.0.0.0";
        port = 443;
        ssl = true;
      }
      {
        addr = "[::0]";
        port = 443;
        ssl = true;
      }
      {
        addr = "0.0.0.0";
        port = 8448;
        ssl = true;
      }
      {
        addr = "[::0]";
        port = 8488;
        ssl = true;
      }
    ];

    addSSL = true;
    extraConfig = ''
      merge_slashes off;
    '';

    locations."/_matrix" = {
      proxyPass = "http://${cfg.settings.global.address}:${toString cfg.settings.global.port}";
      # Recommended by conduit
      extraConfig = ''
        proxy_buffering off;
      '';
    };
  };
}