{pkgs, outputs, ...}: {
  services.cloudflared = {
    enable = true;
    tunnels = {
      "${outputs.secrets.flareTunnelName}" = {
        credentialsFile = "${pkgs.writeText "credentials" outputs.secrets.flareTunnelApi}";
        default = "http_status:404";
        ingress = {
          "*.${outputs.secrets.jimDomain}" = {
            service = "https://localhost:443";
          };
        };
      };
    };
  };
}