{ pkgs, ... }:

let
  cloudflareIpRanges = [
    "103.21.244.0/22"
    "103.22.200.0/22"
    "103.31.4.0/22"
    "104.16.0.0/13"
    "104.24.0.0/14"
    "108.162.192.0/18"
    "131.0.72.0/22"
    "141.101.64.0/18"
    "162.158.0.0/15"
    "172.64.0.0/13"
    "173.245.48.0/20"
    "188.114.96.0/20"
    "190.93.240.0/20"
    "197.234.240.0/22"
    "198.41.128.0/17"
    "2400:cb00::/32"
    "2606:4700::/32"
    "2803:f800::/32"
    "2405:b500::/32"
    "2405:8100::/32"
    "2a06:98c0::/29"
    "2c0f:f248::/32"
  ];
in
{
  services.caddy = {
    enable = true;
    email = "imnyang@pm.me";
    openFirewall = true;
    package = pkgs.caddy.withPlugins {
      plugins = [
        "github.com/caddy-dns/cloudflare@v0.2.4"
        "github.com/aksdb/caddy-cgi/v2@v2.2.6"
        "github.com/shift72/caddy-geo-ip@v0.6.0"
        "github.com/lolPants/caddy-requestid@v1.1.2"
        "github.com/WeidiDeng/caddy-cloudflare-ip@v0.0.0-20231130002422-f53b62aa13cb"
        "github.com/caddyserver/ntlm-transport@v0.1.2"
        "github.com/ueffel/caddy-brotli@v1.6.0"
        "github.com/RussellLuo/caddy-ext/ratelimit@v0.3.0"
        "github.com/neodyme-labs/user_agent_parse@v0.0.1"
      ];
      hash = "sha256-r4MgRk8HpKYx7f8FmA3PKgD/5ZNTIHpQvlE+zRbP0lw=";
    };
    globalConfig = ''
      admin unix//run/caddy/admin.socket
      storage file_system /var/lib/caddy
      servers {
        trusted_proxies static ${builtins.concatStringsSep " " cloudflareIpRanges}
        client_ip_headers Cf-Connecting-Ip
      }
      debug
    '';
  };
}