{
  lib,
  config,
  ...
}:
let
  cfg = config.my.websites.portfolio;
  issoCfg = config.my.servers.isso;
  hugoHeaders = ''
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
  '';
  hugoLocations = {
    "/" = {
      extraConfig = ''
        try_files $uri $uri/ /index.html;
      '';
    };
    "~* \\.html$" = {
      extraConfig = ''
        try_files $uri $uri/ /index.html;
      '';
    };
    "~* \\.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|xml)$" = {
      extraConfig = ''
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
      '';
    };
    "~ /\\.(?!well-known).*" = {
      extraConfig = ''
        return 404;
      '';
    };
    "= /js/script.js" = {
      proxyPass = "https://analytics.lebubu.org";
      extraConfig = ''
        proxy_set_header Host analytics.lebubu.org;
        rewrite ^ /js/script.file-downloads.hash.outbound-links.js break;
      '';
    };
    "= /api/event" = {
      proxyPass = "https://analytics.lebubu.org";
      extraConfig = ''
        proxy_set_header Host analytics.lebubu.org;
      '';
    };
  };
in
{
  options.my.websites.portfolio = {
    enableProxy = lib.mkEnableOption "portfolio and blog static sites";
  };
  config = lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
    services.nginx.virtualHosts = {
      "www.danilo-reyes.com" = {
        forceSSL = true;
        enableACME = true;
        globalRedirect = "danilo-reyes.com";
      };
      "www.blog.danilo-reyes.com" = {
        forceSSL = true;
        enableACME = true;
        globalRedirect = "blog.danilo-reyes.com";
      };
      "danilo-reyes.com" = {
        forceSSL = true;
        enableACME = true;
        root = "/var/www/html/portfolio";
        locations = hugoLocations;
        extraConfig = hugoHeaders;
      };
      "blog.danilo-reyes.com" = {
        forceSSL = true;
        enableACME = true;
        root = "/var/www/html/blog";
        locations = hugoLocations // {
          "^~ /isso" = {
            proxyPass = "http://${issoCfg.ip}:${toString issoCfg.port}";
            extraConfig = ''
              rewrite ^/isso/?(.*)$ /$1 break;
              proxy_set_header Host $host;
            '';
          };
        };
        extraConfig = hugoHeaders;
      };
    };
  };
}