{
  machineConfig,
  config,
  lib,
  ...
}:

{

  options.zpha.websites."ctu.cx".enable = lib.mkEnableOption "";

  config = lib.mkIf config.zpha.websites."ctu.cx".enable {
    dns.zones."ctu.cx".AAAA = lib.singleton machineConfig.networking.ip6Address;

    services.nginx.virtualHosts."ctu.cx" = {
      useACMEHost = "${config.networking.fqdn}";
      forceSSL = true;
      kTLS = true;
    };
  };

}