{ config, ... }:
{
  services.nginx = {
    enable = true;
    group = "mastodon";
    upstreams.streaming = {
      extraConfig = ''
        least_conn;
      '';
      servers = {
        "unix:/run/mastodon-streaming/streaming-1.socket" = {
          fail_timeout = "0";
        };
        "unix:/run/mastodon-streaming/streaming-2.socket" = {
          fail_timeout = "0";
        };
        "unix:/run/mastodon-streaming/streaming-3.socket" = {
          fail_timeout = "0";
        };
      };
    };
    virtualHosts."social.nekover.se" = {
      forceSSL = true;
      enableACME = true;
      listen = [
        {
          addr = "0.0.0.0";
          port = 80;
        }
        {
          addr = "0.0.0.0";
          port = 8443;
          ssl = true;
          extraParameters = [ "proxy_protocol" ];
        }
      ];

      root = "${config.services.mastodon.package}/public/";

      locations = {
        "/" = {
          tryFiles = "$uri @proxy";
        };

        "/system/".alias = "/var/lib/mastodon/public-system/";

        "^~ /api/v1/streaming" = {
          proxyPass = "http://streaming";
          proxyWebsockets = true;
        };

        "@proxy" = {
          proxyPass = "http://unix:/run/mastodon-web/web.socket";
          proxyWebsockets = true;
        };
      };

      extraConfig = ''
        set_real_ip_from 10.202.41.100;
        real_ip_header proxy_protocol;
      '';
    };
  };
}