{
  config,
  pkgs,
  device,
  ...
}: {
  networking.domains.subDomains = {
    "code.darksailor.dev".a.data = device.tailscaleIp;
  };

  sops = {
    secrets."cloudflare/cf_api_key".owner = config.services.caddy.user;
    templates = {
      "CLOUDFLARE_API_KEY.env".content = ''
        CLOUDFLARE_API_KEY=${config.sops.placeholder."cloudflare/cf_api_key"}
      '';
    };
  };
  services = {
    caddy = {
      enable = true;
      globalConfig = ''
        servers {
          metrics
        }
      '';
      extraConfig = ''
        (cloudflare) {
            tls {
                propagation_timeout -1
                propagation_delay 120s
                dns cloudflare {env.CLOUDFLARE_API_KEY}
                resolvers 1.1.1.1
            }
        }
      '';
      package = pkgs.caddyWithCloudflare;
      virtualHosts."code.darksailor.dev".extraConfig = ''
        import cloudflare
        reverse_proxy localhost:4096
      '';
    };
  };
  systemd.services.caddy = {
    after = ["sops-install-secrets.service"];
    serviceConfig = {
      EnvironmentFile = config.sops.templates."CLOUDFLARE_API_KEY.env".path;
    };
  };
}