{
  lib,
  cloudflareRanges,
  ...
}: {
  imports = [../cloudflared.nix];

  # everything nginx sees arrives through the tunnel, so the client ip has to come from
  # cloudflare's header
  services.nginx.commonHttpConfig = ''
    ${lib.concatMapStrings (range: "set_real_ip_from ${range};
") cloudflareRanges}
    real_ip_header CF-Connecting-IP;
  '';
}