{
  config,
  pkgsUnstable,
  lib,
  ...
}: let
  domain = "redlib.vhack.eu";

  cfg = config.vhack.redlib;
in {
  options.vhack.redlib = {
    enable = lib.mkEnableOption ''
      the redlib reddit frontend
    '';
  };

  config = lib.mkIf cfg.enable {
    services.redlib = {
      enable = true;
      package = pkgsUnstable.redlib;
      port = 8080;
      address = "127.0.0.1";
      openFirewall = false;
    };

    services.nginx = {
      enable = true;
      virtualHosts.${domain} = {
        locations."/".proxyPass = "http://127.0.0.1:${toString config.services.redlib.port}";

        enableACME = true;
        forceSSL = true;
      };
    };

    # TODO(@bpeetz): Remove this at some point. <2025-02-04>
    vhack.nginx.redirects = {
      "libreddit.vhack.eu" = "${domain}";
    };
  };
}