{
  config,
  lib,
  pkgs,
  ...
}:
let
  port = 5005;
in
{

  # generate private key with:
  # nix-store --generate-binary-cache-key my-secret-key my-public-key
  clan.core.facts.services."nix-serve" = {
    secret."nix-serve.key" = { };
    public."nix-serve.pub" = { };
    generator.path = with pkgs; [
      coreutils
      nix
    ];
    generator.script = ''
      nix-store --generate-binary-cache-key "cache.${config.networking.hostName}.wg0" nix-serve.key nix-serve.pub
      mv nix-serve.key "$secrets"/nix-serve.key
      mv nix-serve.pub "$facts"/nix-serve.pub
    '';
  };

  services.harmonia = {
    enable = true;
    signKeyPaths = [ config.clan.core.facts.services.nix-serve.secret."nix-serve.key".path ];
    settings = {
      bind = "127.0.0.1:${toString port}";
      priority = 100;
    };
  };

  healthchecks.closed.public.ports.nix-cache = [ port ];
  healthchecks.http.nix-cache = {
    url = "cache.${config.networking.hostName}.wg0/nix-cache-info";
    expectedContent = "Priority: ${toString config.services.harmonia.settings.priority}";
  };

  services.nginx = {
    enable = true;
    virtualHosts."cache.${config.networking.hostName}.wg0" = {
      locations."/".extraConfig = ''
        proxy_pass http://localhost:${toString port};
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        allow ${config.wireguard.wg0.subnet};
        deny all;
      '';
    };
  };
}