{ pkgs, lib, config, ... }:
{
  services.webstack.instances."api.ebs.cloonar.dev" = {
    enableDefaultLocations = false;
    enableMysql = true;
    authorizedKeys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIqpF703JmLTBpBjTSvC0bnYu+lSYdmaGPHxMnHEbMmp"
    ];
    extraConfig = ''
      add_header X-Frame-Options "SAMEORIGIN";
      add_header X-Content-Type-Options "nosniff";

      index index.php;

      charset utf-8;

      error_page 404 /index.php;
    '';
    locations."/favicon.ico".extraConfig = ''
      log_not_found off;
      access_log off;
    '';
    locations."/robots.txt".extraConfig = ''
      access_log off;
      log_not_found off;
    '';

    locations."/".extraConfig = ''
      try_files $uri $uri/ /index.php$is_args$args;
    '';
    phpPackage = pkgs.php82.withExtensions ({ enabled, all }:
      enabled ++ [ all.imagick ]);
  };

  # Use HTTP-01 challenge for Let's Encrypt
  services.nginx.virtualHosts."api.ebs.cloonar.dev".acmeRoot = lib.mkForce "/var/lib/acme/acme-challenge";
}