{
  config,
  ...
}:
{
  services.rabbi-gerzi = {
    enable = true;
    frontend = {
      hostName = "rabbigerzi.yisroelbaum.com";
      nginx = {
        forceSSL = true;
        enableACME = true;
      };
    };
    backend = {
      hostName = "rabbigerziapi.yisroelbaum.com";
      environmentFile = config.sops.secrets."rabbi-gerzi-env".path;
      nginx = {
        forceSSL = true;
        enableACME = true;
      };
    };
  };

  sops.secrets."rabbi-gerzi-env" = {
    sopsFile = ./secrets/rabbi-gerzi.env;
    format = "dotenv";
    key = "";
    mode = "0400";
    owner = config.services.rabbi-gerzi.user;
    group = config.services.rabbi-gerzi.group;
  };
}