{ ... }:
{
  services.nix-serve = {
    enable = true;
    port = 5005;
    bindAddress = "localhost";
    secretKeyFile = "/secrets/signing-key.secret";
  };
}