{
  config,
  pkgs,
  ...
}: let
  domain = "grafana.radicle.dev";
  port = 3000;
in {
  services = {
    grafana = {
      enable = true;
      settings = {
        server = {
          http_addr = "127.0.0.1";
          http_port = port;
          domain = domain;
        };
      };
    };

    nginx.virtualHosts.${domain} = {
      enableACME = true;
      forceSSL = true;
      serverName = domain;
      locations."/" = {
        proxyPass = "http://127.0.0.1:${builtins.toString port}";
        extraConfig = ''
          client_max_body_size 512m;
          proxy_set_header Host ${domain};
          proxy_set_header Origin https://${domain};
        '';
      };
    };

    nginx.virtualHosts."grafana.radicle.xyz" = {
      enableACME = true;
      forceSSL = true;
      globalRedirect = domain;
      redirectCode = 302;
    };
  };
}