{
  config,
  pkgs,
  ...
}:
{
  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud32;
    hostName = "cloud.lelgenio.com";
    https = true;
    config = {
      dbtype = "sqlite"; # TODO: move to single postgres db
      adminpassFile = config.sops.secrets."nextcloud/default-password".path;
    };
  };

  services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
    forceSSL = true;
    enableACME = true;
  };

  sops.secrets."nextcloud/default-password" = {
    mode = "400";
    owner = "nextcloud";
    group = "nextcloud";
  };
}