{
  config,
  caddy,
  kjv,
  ...
}:
let
  caddyPkg = caddy.packages.x86_64-linux.default;
  kjvPkg = kjv.defaultPackage.x86_64-linux;
in
{

  security.wrappers = {
    caddy = {
      source = "${caddyPkg}/bin/caddy";
      owner = "root";
      group = "wheel";
      capabilities = "cap_net_bind_service+eip";
    };
  };

  systemd.user.services.caddy = {
    enable = true;
    description = "Custom Caddy";
    serviceConfig = {
      Type = "simple";
      ExecStart = "${config.security.wrapperDir}/caddy run";
      WorkingDirectory = "/home/alex";
    };
    environmentFiles = [
      config.age.secrets."cloudflare.env".path
    ]
    wantedBy = [ "multi-user.target" ];
  };

  systemd.user.services.kjv = {
    enable = true;
    description = "KJV Bible";
    serviceConfig = {
      Type = "simple";
      ExecStart = "${kjvPkg}/bin/kjv";
    };
    wantedBy = [ "multi-user.target" ];
  };

  services.avahi = {
    enable = true;
    nssmdns4 = true;
    openFirewall = true;
    publish = {
      enable = true;
      userServices = true;
      addresses = true;
    };
  };

  environment.systemPackages = [
    caddyPkg
    kjvPkg
  ];

  age.secrets."cloudflare.env" = {
    file = ../secrets/cloudflare.env.age;
    mode = "400";
    owner = "alex";
  };
}