{config, ...}: let
  domain = "push.${config.customOps.domain.fqdn}";
  ntfyPort = "8080";
  mollyPort = "8020";
in {
  sops.secrets = {
    "push/mollysocket" = {};
  };

  services.ntfy-sh = {
    enable = true;
    settings = {
      listen-http = ":${ntfyPort}";
      base-url = "https://${domain}";
      behind-proxy = true;
      auth-file = "/var/lib/ntfy-sh/user.db";
      auth-default-access = "deny-all";
      enable-signup = false;
      auth-access = [
        "*:up*:write-only"
      ];
    };
  };

  services.mollysocket = {
    enable = true;
    settings = {
      host = "127.0.0.1";
      allowed_endpoints = [
        "https://${domain}"
      ];
    };
    environmentFile = config.sops.secrets."push/mollysocket".path;
  };

  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:${ntfyPort}";
      proxyWebsockets = true;
    };
  };

  services.nginx.virtualHosts."mollysocket.${domain}" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:${mollyPort}";
      proxyWebsockets = true;
      extraConfig = ''
        proxy_set_header Host $host;
        proxy_set_header X-Original-URL $request_uri;
      '';
    };
  };
}