{...}: {
  services = {
    # use nginx as the reverse proxy
    # (also will use certbot and Let's Encrypt)
    # refer to: https://nixos.wiki/wiki/Nginx
    nginx = {
      enable = true;

      recommendedProxySettings = true;
      recommendedTlsSettings = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;

      # https://imbored.dev
      virtualHosts = {
        "imbored.dev" = {
          forceSSL = true;
          enableACME = true;
          # config reverse proxy paths
          locations = {
            "/" = {
              # TODO
              proxyPass = "http://127.0.0.1:12345";
            };
          };
        };
      };
    };
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "eclarkboman@gmail.com";
  };
}