{ config, ... }:
{
  services.cloudflared = {
    enable = true;
    certificateFile = config.age.secrets.cloudflared-cert.path;
    tunnels = {
      "cragmont" = {
        credentialsFile = config.age.secrets.cloudflared-tunnel.path;
        default = "http_status:404";
        ingress = {
          "git.fcuny.net".service = "ssh://127.0.0.1:22";
        };
      };
    };
  };
}