{
  secrets,
  config,
  ...
}:
{
  services.miniflux = {
    enable = true;
    adminCredentialsFile = config.age.secrets.miniflux-admin-creds.path;
    config = {
      BASE_URL = "https://rss.lan";
      LISTEN_ADDR = "127.0.0.1:8055";
    };
  };

  services.nginx.privateVirtualHosts."rss.lan" = {
    locations."/" = {
      proxyPass = "http://${config.services.miniflux.config.LISTEN_ADDR}";
    };
  };

  users.users.miniflux = {
    isSystemUser = true;
    group = "miniflux";
  };
  users.groups.miniflux = { };

  age.secrets.miniflux-admin-creds = {
    file = secrets.roam."miniflux-admin-creds.age";
    mode = "440";
    owner = "miniflux";
    group = "miniflux";
  };
}