{
  config,
  site_config,
  service_configs,
  lib,
  ...
}:
{
  imports = [
    (lib.serviceMountWithZpool "continuwuity" service_configs.zpool_ssds [
      "/var/lib/private/continuwuity"
    ])
    (lib.serviceFilePerms "continuwuity" [
      "Z /var/lib/private/continuwuity 0770 ${config.services.matrix-continuwuity.user} ${config.services.matrix-continuwuity.group}"
    ])
    (lib.mkCaddyReverseProxy {
      domain = service_configs.matrix.domain;
      port = service_configs.ports.private.matrix.port;
    })
  ];

  services.matrix-continuwuity = {
    enable = true;

    settings.global = {
      port = [ service_configs.ports.private.matrix.port ];
      server_name = site_config.domain;
      allow_registration = true;
      registration_token_file = config.age.secrets.matrix-reg-token.path;

      new_user_displayname_suffix = "";

      trusted_servers = [
        "matrix.org"
        "constellatory.net"
        "tchncs.de"
        "envs.net"
      ];

      address = [
        "0.0.0.0"
      ];

      # TURN server config (coturn)
      turn_secret_file = config.age.secrets.matrix-turn-secret.path;
      turn_uris = [
        "turn:${site_config.domain}?transport=udp"
        "turn:${site_config.domain}?transport=tcp"
      ];
      turn_ttl = 86400;
    };
  };

  services.caddy.virtualHosts.${site_config.domain}.extraConfig = lib.mkBefore ''
    header /.well-known/matrix/* Content-Type application/json
    header /.well-known/matrix/* Access-Control-Allow-Origin *
    respond /.well-known/matrix/server `{"m.server": "${service_configs.matrix.domain}:${builtins.toString service_configs.ports.public.https.port}"}`
    respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-continuwuity.settings.global.server_name}"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://${service_configs.livekit.domain}"}]}`
  '';

  # Exact duplicate for federation port
  services.caddy.virtualHosts."${service_configs.matrix.domain}:${builtins.toString service_configs.ports.public.matrix_federation.port}".extraConfig =
    config.services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig;

  # for federation
  networking.firewall.allowedTCPPorts = [
    service_configs.ports.public.matrix_federation.port
  ];

  # for federation
  networking.firewall.allowedUDPPorts = [
    service_configs.ports.public.matrix_federation.port
  ];
}