{ config, ... }:
{
  nix.settings.allowed-users = [ "harmonia" ];
  services.caddy.virtualHosts."cache.fuwn.me".extraConfig = "reverse_proxy localhost:5000";

  services.harmonia = {
    enable = true;
    signKeyPaths = [ config.sops.secrets.harmonia.path ];
  };
}