#
# Configuration for serving a binary cache from a machine.
#
{ config, ... }:
{
  # Build our basic store service...
  services.nix-serve = {
    enable = true;
    secretKeyFile = "/var/cache-priv-key.pem";
  };

  # ... and serve it over tailscale.
  services.nginx = {
    enable = true;
    recommendedProxySettings = true;

    virtualHosts = {
      "${config.networking.hostName}.kate.ts.polytheon.org" = {
        locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
      };
    };
  };
}