{ config, lib, pkgs, ... }:

{
  services.murmur = {
    enable = false;
    logDays = -1;
    welcometext = "Welcome to mumble4future! Brought to you by infra4future";
    sslKey = "/var/lib/acme/mumble.hacc.space/key.pem";
    sslCert = "/var/lib/acme/mumble.hacc.space/fullchain.pem";
  };

  networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
  networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];

  services.nginx.virtualHosts."mumble.hacc.space" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "https://stuebinm.4future.dev/mumble.infra4future.de/";
    };
  };
  # set ACLs so that the murmur user can read the certificates
  security.acme.certs."mumble.hacc.space".postRun = "setfacl -Rm u:murmur:rX /var/lib/acme/mumble.hacc.space";
}