{
  config,
  lib,
  pkgs,
  ...
}: let
  corsConfig = ''
    more_set_headers 'Access-Control-Allow-Origin: *';
    more_set_headers 'Access-Control-Allow-Methods: GET, POST, OPTIONS';
    more_set_headers 'Access-Control-Allow-Headers: Authorization, Content-Type, atproto-proxy';

    if ($request_method = 'OPTIONS') {
      add_header 'Access-Control-Max-Age' 86400;
      return 204;
    }
  '';
in {
  options.services.nginx.virtualHosts = lib.mkOption {
    type = lib.types.attrsOf (lib.types.submodule {
      options.locations = lib.mkOption {
        type = lib.types.attrsOf (lib.types.submodule ({config, ...}: {
          options.allowCors = lib.mkEnableOption "CORS headers for this location";
          config.extraConfig = lib.mkIf config.allowCors corsConfig;
        }));
      };
    });
  };

  config.services.nginx = {
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    additionalModules =
      lib.mkIf
      (lib.any
        (vhost: lib.any (location: location.allowCors) (lib.attrValues vhost.locations))
        (lib.attrValues config.services.nginx.virtualHosts))
      [pkgs.nginxModules.moreheaders];
  };
}