{
  pkgs,
  lib,
  config,
  ...
}: {
  networking.firewall.allowedTCPPorts = [80 8448 443];

  services.caddy = {
    package = pkgs.caddy.withPlugins {
      plugins = ["github.com/caddy-dns/porkbun@v0.2.1"];
      hash = "sha256-X8QbRc2ahW1B5niV8i3sbfpe1OPYoaQ4LwbfeaWvfjg=";
    };
    enable = true;
    enableReload = false;
    adapter = "caddyfile";
    environmentFile = config.age.secrets.caddy_porkbun_api_env.path;
    configFile = ./Caddyfile;
  };
}