{ ... }:

{
  # Configure nginx to serve /nas/doc/website/mirror/
  services.nginx = {
    enable = true;
    virtualHosts."mirror.catacomb.home" = {
      listen = [
        { addr = "10.22.20.2"; }
        # Binding to 10.22.20.2:80 here confuses the empyrean revproxy, even when the revproxy
        # is configured with the same hostname, and it serves from fileserver.nix instead.
        # This nonstandard port supports the revproxy use case.
        { addr = "10.22.20.2"; port = 7474; }
      ];
      root = "/nas/doc/website/mirror";
    };
  };

  networking.firewall.allowedTCPPorts = [ 7474 ];

  users.users.nginx.extraGroups = ["nas"];
}