{ config, pkgs, ... }:
{
  services.nginx = {
    additionalModules = [ pkgs.nginxModules.subsFilter ];
    virtualHosts.git = {
      serverName = "git.${config.networking.domain}";
      enableACME = true;
      forceSSL = true;
      locations."/" = {
        # proxyPass as an IP so nginx doesn't fail if the upstream isn't available
        proxyPass = "http://100.64.0.3/git/"; # hephaistos.aristote.mesh
        extraConfig = ''
          proxy_redirect default;
          # fix internal hyperlinks
          proxy_set_header Accept-Encoding "";
          subs_filter "href='/git/" "href='/";
          subs_filter "action='/git/" "action='/";
          subs_filter "href='/([^/]*)/([^/]*)/'" "href=/$1/$2/tree/" r;
        '';
      };
    };
  };
}