{ config, lib, ... }:
let
  cfg = config.custom.services.nginxHttpsServer;
in
{
  options = {
    custom.services.nginxHttpsServer.enable = lib.mkEnableOption "default nginx HTTPS server configuration";

    services.nginx.virtualHosts = lib.mkOption {
      type = lib.types.attrsOf (
        lib.types.submodule {
          config = lib.mkIf cfg.enable (
            lib.mkDefault {
              forceSSL = true;
              kTLS = true;
            }
          );
        }
      );
    };
  };

  config = lib.mkIf cfg.enable {
    networking.firewall.allowedTCPPorts = [ 443 ];

    services.nginx = {
      enable = true;
      recommendedOptimisation = true;
      recommendedTlsSettings = true;
      recommendedProxySettings = true;
    };
  };
}