{ config, ... }:

let hostname = "documentserver.dgnum.eu";
in {
  services.onlyoffice = {
    inherit hostname;

    enable = true;

    jwtSecretFile = config.age.secrets."onlyoffice-jwt_secret_file".path;

    port = 8015;
  };

  services.nginx.virtualHosts.${hostname} = {
    enableACME = true;
    forceSSL = true;
  };

  dgn-secrets.matches."^onlyoffice-.*$" = { owner = "onlyoffice"; };
}