{config, ...}: let
  ntfyDomain = "push.${config.customOps.domain.fqdn}";
  listen = "127.0.0.1:2586";
in {
  services.ntfy-sh = {
    enable = true;
    settings = {
      base-url = "https://${ntfyDomain}";
      behind-proxy = true;
      auth-access = ["*:up*:write-only"];
      listen-http = listen;
    };
  };

  services.nginx.virtualHosts.${ntfyDomain} = {
    forceSSL = true;
    enableACME = true;
    locations."/".proxyPass = "http://${listen}";
  };
}