{ config, ... }:
{

  services.nginx.virtualHosts.${config.services.grafana.domain} = {
    extraConfig = ''
      allow ${config.tinc.private.subnet};
      deny all;
    '';
    locations."/" = {
      proxyPass = "http://localhost:${toString config.services.grafana.port}";
      proxyWebsockets = true;
    };
  };

  services.grafana = {
    enable = true;
    domain = "grafana.robi.private";
    port = 2342;
    addr = "localhost";
  };

}