{ config, pkgs, lib, ... }:

{
  services.nginx.virtualHosts."totap.de" = {
    serverAliases = [ "www.totap.de" ];
    enableACME = true;
    forceSSL = true;
    root = "/var/www/totap";
  };

  users.users.deploy-totap = {
    isNormalUser = true;
    description = "Deploy user for totap.de";
    createHome = true;
    home = "/home/deploy-totap";
    group = "deploy-totap";
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBJeuS1n+MjSy9NuQ4z6Z5jzr59kUVQgj627o0Vuc+Q github-actions-totap-deploy"
    ];
  };

  users.groups.deploy-totap = { };

  systemd.tmpfiles.rules = [
    "d /var/www/totap 0755 deploy-totap deploy-totap -"
  ];
}