{
  config,
  lib,
  registry,
  ...
}:
let
  giteaAddress = registry.address.${config.networking.hostName}.gitea;
in
{
  config = lib.mkIf config.guests.reverse-proxy.enable {
    guests.reverse-proxy = {
      interior = {
        modules.services.reverse-proxy.enable = true;

        services.nginx.virtualHosts = {
          "git.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://${giteaAddress}:3000";
          };
          "photos.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
          "plex.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
          "servers.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
          "todo.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
          "wings.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
            locations."/".proxyPass = "http://10.23.20.32";
          };
        };

        networking.firewall.allowedTCPPorts = [ 22 ];

        services.nginx.streamConfig = ''
          server {
            listen 22;
            proxy_pass ${giteaAddress}:2222;
          }
        '';
      };

      limits = {
        memory = lib.mkDefault "1G";
        cpu = lib.mkDefault "100%";
        tasksMax = lib.mkDefault 256;
      };
    };
  };
}