{
  config,
  lib,
  ...
}:
let
  giteaSshBackend = "10.23.20.45:2022";
in
{
  config = lib.mkIf config.guests.reverse-proxy.enable {
    guests.reverse-proxy = {
      interior = {
        modules.services.reverse-proxy.enable = true;

        services.nginx.virtualHosts = {
          "games.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
          "git.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
          "photos.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
          "plex.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
          "servers.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
          "todo.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
          "wings.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
        };

        networking.firewall.allowedTCPPorts = [ 2022 ];

        services.nginx.streamConfig = ''
          server {
            listen 2022;
            proxy_pass ${giteaSshBackend};
          }
        '';
      };

      limits = {
        memory = lib.mkDefault "1G";
        cpu = lib.mkDefault "100%";
        tasksMax = lib.mkDefault 256;
      };
    };
  };
}