{ lib, ... }: { options.services.nginx.virtualHosts = lib.mkOption { type = lib.types.attrsOf ( lib.types.submodule { config = lib.mkDefault { forceSSL = true; kTLS = true; }; } ); }; config = { networking.firewall.allowedTCPPorts = [ 443 ]; services.nginx = { enable = true; recommendedGzipSettings = true; recommendedOptimisation = true; recommendedTlsSettings = true; recommendedProxySettings = true; }; }; }