{ config, ... }: {
  services.influxdb = {
    enable = true;
    extraConfig = {
      http = {
        auth-enabled = true;
        log-enabled = false;
        https-enabled = true;
        https-certificate = "/var/lib/acme/influxdb.cloonar.com/fullchain.pem";
        https-private-key = "/var/lib/acme/influxdb.cloonar.com/key.pem";
      };
    };
  };

  networking.firewall.allowedTCPPorts = [ 8086 ];

  security.acme.certs."influxdb.cloonar.com" = {
    postRun = "systemctl restart influxdb.service";
    group = "influxdb";
  };
}