{
  config,
  lib,
  ...
}:
let
  giteaSshBackend = "10.23.20.45:2022";
in
{
  config = lib.mkIf config.guests.reverse-proxy.enable {
    guests.reverse-proxy = {
      interior = {
        modules.services.reverse-proxy.enable = true;

        services.nginx.virtualHosts =
          lib.genAttrs
            [
              "games.alexion.dev"
              "git.alexion.dev"
              "photos.alexion.dev"
              "plex.alexion.dev"
              "servers.alexion.dev"
              "todo.alexion.dev"
              "wings.alexion.dev"
            ]
            (_domain: {
              forceSSL = true;
              enableACME = true;
              locations."/".proxyPass = "http://10.23.20.32";
            });

        networking.firewall.allowedTCPPorts = [ 2022 ];

        services.nginx.streamConfig = ''
          server {
            listen 2022;
            proxy_pass ${giteaSshBackend};
          }
        '';
      };

      limits = {
        memory = lib.mkDefault "1G";
        cpu = lib.mkDefault "100%";
        tasksMax = lib.mkDefault 256;
      };
    };
  };
}