{ ... }: {
  networking = {
    firewall.allowedTCPPorts = [
      # nginx
      80
      443
    ];
  };

  security.acme = {
    defaults.email = "acme@fcuny.net";
    acceptTerms = true;
  };

  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    virtualHosts = {
      "fcuny.net" = {
        addSSL = true;
        enableACME = true;
        locations = {
          "/" = {
            root = "/srv/www/fcuny.net";
          };
        };
      };
    };
  };
}