{
  services = {
    adguardhome.enable = true;
    nginx.virtualHosts."guard.${outputs.secrets.jimDomain}" =  {
      enableACME = true;
      forceSSL = true;
      locations."/" = {
        proxyPass = "http://127.0.0.1:3000";
        proxyWebsockets = true;
      };
    };
  };
  networking.firewall.allowedUDPPorts = [ 53 ];
}