{ config, ... }:
let
  immich = config.services.immich;
  gogs = config.containers.gogs;
in
{
  services.cloudflared = {
    enable = true;
    certificateFile = config.age.secrets."odin/services/cloudflared".path;

    tunnels."71c89a7f-2467-444c-9fda-4864860dc8c4" = {
      default = "http_status:404";
      credentialsFile = config.age.secrets."odin/services/cloudflared-tunnel".path;

      ingress = {
        "photos.t5.st".service = "http://${immich.host}:${toString immich.port}";
        "git.t5.st".service = "http://${gogs.localAddress}:3000";
      };
    };
  };
}