{
  inputs ? null,
  flake ? null,
  self ? null,
  ...
}:
{
  config ? null,
  pkgs ? null,
  lib ? null,
  modulesPath ? null,
  ...
}:
with builtins;
with lib;
let
  domainsFrom = ["vproxy.store" "vproxy.cc"];
  domainTo = "vproxy.cc";
in {
  imports = [
    inputs.util.nixosModules.hectic
  ];

  hectic = {
    archetype.dev.enable = true;
  };

  boot.loader.grub.device =  "/dev/vda";
  boot.initrd.availableKernelModules = [
    "ata_piix"
    "uhci_hcd"
    "xen_blkfront"
  ] ++ (if pkgs.system != "aarch64-linux" then [ "vmw_pvscsi" ] else []);
  boot.initrd.kernelModules = ["nvme"];
  fileSystems."/" = {
    device = "/dev/vda1";
    fsType = "ext4";
  };

  environment.systemPackages = with pkgs; [ rsync git ];

  users.users.root.openssh.authorizedKeys.keys = [
    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKO6o5mY1wIrm9VzJogqECZO/GXVfwChi44OkVc7UiEG yukkop@nixos''
  ];

  security.acme = {
    acceptTerms = true;
    defaults = {
      email = "hectic.yukkop.it@gmail.com";
      # group = "nginx";
      enableDebugLogs = true;
    };
  };


  networking.firewall.allowedTCPPorts = [ 80 443 ];

  services.nginx = {
    enable = true;

    # TODO: use shared.nix to use same nginx config for both main and proxy systems
    logError = "/var/log/nginx/error.log info";

    commonHttpConfig = ''
      # Custom log format for detailed access logs
      log_format detailed '$remote_addr - $remote_user [$time_local] '
                          '"$request" $status $body_bytes_sent '
                          '"$http_referer" "$http_user_agent" '
                          'rt=$request_time uct="$upstream_connect_time" '
                          'uht="$upstream_header_time" urt="$upstream_response_time" '
                          'cs=$upstream_cache_status '
                          'host="$host" '
                          'request_id="$request_id" '
                          'request_body="$request_body"';

      # Custom log format specifically for debugging 404s
      log_format debug_404 '$remote_addr - $remote_user [$time_local] '
                           '"$request" $status $body_bytes_sent '
                           '"$http_referer" "$http_user_agent" '
                           'host="$host" '
                           'uri="$uri" '
                           'request_uri="$request_uri" '
                           'args="$args" '
                           'document_root="$document_root" '
                           'request_filename="$request_filename" '
                           'fastcgi_script_name="$fastcgi_script_name"';

      # Set up conditional logging for 404 errors
      map $status $is_404 {
        default 0;
        404 1;
      }
    '';

    virtualHosts = lib.mkMerge [
      (lib.mkMerge (map (domainFrom: {
        "${domainFrom}" = {
          forceSSL   = true;
          enableACME = true;
        
          locations."/" = {
            proxyPass       = "https://${domainTo}";
            proxyWebsockets = true;
            extraConfig     = ''
              proxy_set_header Host              $host;
              proxy_set_header X-Real-IP         $remote_addr;
              proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
              proxy_set_header Referer https://${domainTo}/;
        
              proxy_buffering off;               # optional: disable buffers for streams
              proxy_read_timeout  60s;
              proxy_send_timeout  60s;
            '';
          };
        };
      }) domainsFrom))
      {
        "default_server" = {
          extraConfig = ''
            return 404;
          '';
        };
      }
    ];
  };
}
