{ config, ... }:
{

  services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
    extraConfig = ''
      allow ${config.tinc.private.subnet};
      deny all;
    '';
    locations."/" = {
      proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
      proxyWebsockets = true;
    };
  };

  services.grafana = {
    enable = true;
    settings.server = {
      domain = "grafana.pepe.private";
      http_port = 2342;
      http_addr = "localhost";
    };
  };

}