nix-infra/config/hosts/web-public-2/virtualHosts/nekover.se.nix

{ ... }:
{
  services.nginx.virtualHosts."nekover.se" = {
    forceSSL = true;
    enableACME = true;
    listen = [
      { 
        addr = "localhost";
        port = 1234;
      } # workaround for enableACME check
      {
        addr = "localhost";
        port = 8443;
        ssl = true;
        proxyProtocol = true;
      }
    ];
    locations."/.well-known/matrix/server" = {
      return = "200 '{\"m.server\": \"matrix.nekover.se:443\"}'";
      extraConfig = ''
        add_header Content-Type application/json;
      '';
    };
    locations."/.well-known/matrix/client" = {
      return = "200 '{\"m.homeserver\": {\"base_url\": \"https://matrix.nekover.se\"}, \"m.identity_server\": {\"base_url\": \"https://vector.im\"}}'";
      extraConfig = ''
        default_type application/json;
        add_header Access-Control-Allow-Origin *;
      '';
    };
  };
}