{ config, lib, pkgs, vhosts ? { }, domains ? [ ], ... }:

let
  served = lib.filterAttrs (k: _: builtins.elem k domains) vhosts;
  enabled = served != { };
in {
  config = lib.mkIf enabled {
    services.nginx = {
      enable = true;
      virtualHosts = lib.mapAttrs (name: vhost:
        let
          port = vhost.ports.http or 80;
        in {
          enableACME = vhost.enableACME or false;
          forceSSL = vhost.enableACME or false;
          extraConfig = vhost.extraConfig or "";
          locations."/" = {
            proxyPass = "http://localhost:${toString port}";
            proxyWebsockets = vhost.websockets or false;
          };
        }
      ) served;
    };

    networking.firewall.allowedTCPPorts = [ 80 443 ];
  };
}