{ ... }:

{
  services.hedgedoc = {
    enable = true;
    settings = {
      domain = "md.clerie.de";
      protocolUseSSL = true;
      db = {
        dialect = "postgres";
        host = "/run/postgresql";
      };
      port = 3835;
      host = "::1";

      allowEmailRegister = false;
    };
  };

  services.postgresql = {
    ensureDatabases = [ "hedgedoc" ];
    ensureUsers = [
      {
        name = "hedgedoc";
        ensureDBOwnership = true;
      }
    ];
  };

  services.nginx.virtualHosts = {
    "md.clerie.de" = {
      enableACME = true;
      forceSSL = true;
      locations = {
        "/" = {
          proxyPass = "http://[::1]:3835";
          proxyWebsockets = true;
        };
      };
    };
  };
}